CVE-2026-53662
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk14th percentile — higher than 14% of all known CVEs
Summary
Immich, a photo and video management solution, has a reflected XSS vulnerability on the /auth/login page. An attacker can take over an authenticated user's account with a single link click.
Risk Assessment
This vulnerability allows an attacker to gain full control over a user's account, leading to persistent account takeover. It may result in data breaches and other serious consequences for the organization.
Recommendation
It is recommended to update Immich to the version containing the fix introduced in commit 4eb1003. Additionally, implementing extra security measures to minimize the risk of XSS attacks is advisable.
Original NVD description (English source)
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.