CVE-2026-53662 Details
Description
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.
A reflected cross-site scripting vulnerability has been identified in Immich, a self-hosted photo and video management solution. This issue is present in the main branch builds from commit 4ffa26c9 until 4eb1003, including the :main Docker tag and any nightly builds. The vulnerability allows an attacker to fully compromise an authenticated user's account with a single click. It arises because the continue query parameter is extracted from the URL and passed to SvelteKit's redirect() function without proper validation of the scheme or origin. This oversight enables the execution of attacker-controlled JavaScript within Immich's origin, using the victim's session to generate an all-permission API key, resulting in a persistent account takeover.
Users can update to the latest version of Immich, where this vulnerability has been patched. Instructions for updating are available in the Immich repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 23, 2026CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3 | [email protected] | Source CodeVendor |
| https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| immich | >= 4ffa26c9, < 4eb1003 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 23, 2026 | New CVE Received | [email protected] |