The issue concerns Querybook, an open source data querying UI. In affected versions, user-provided data is not escaped in the error field of the auth callback URL in `querybook/server/app/auth/oauth auth.py` and `querybook/server/app/auth/okta auth.py`. This may allow attackers to perform reflected cross-site scripting (XSS) if Content Security Policy (CSP) is not enabled or `unsafe-inline` is allowed.