A stored cross-site scripting issue exists in the `service label` helper, which incorrectly marks unescaped OAuth service display names as `html safe`. Authenticated attackers can connect an OAuth account using a crafted nickname, name, or email and share it globally. This allows the execution of JavaScript when victims attach the account to Agents and view them. Potential impacts include the exposure of Credentials, Agents, and Events, as well as the execution of admin actions if the victim has administrator privileges.