Open Redirect CVE-2026-40096

Q: What is the CVSS score of CVE-2026-40096?

CVE-2026-40096 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 GitHub_M

XSS Open Redirect

5.1

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Apr 17, 2026 - 18:03 vuln.today

CVSS changed

Apr 17, 2026 - 15:52 NVD

5.1 (MEDIUM)

Analysis Generated

Apr 15, 2026 - 01:15 vuln.today

CVE Published

Apr 14, 2026 - 23:54 nvd

MEDIUM 5.1

DescriptionGitHub Advisory

immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, where the album name is inserted unsanitized into a <meta> tag in api.service.ts. A registered attacker can create a shared album with a crafted name containing 0;url=https://attackersite.com" http-equiv="refresh, which when rendered in the <meta property="og:title"> tag causes the victim's browser to redirect to an attacker-controlled site upon opening the share link. This facilitates phishing attacks, as the attacker could host a modified version of immich that collects login credentials from victims who believe they need to authenticate to view the shared album. This issue has been fixed in version 2.7.3.

AnalysisAI

Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared album names that inject unsanitized HTML into Open Graph meta tags, redirecting victims' browsers to attacker-controlled sites when they open the share link. This enables phishing attacks where victims can be directed to credential-harvesting sites that impersonate the Immich login interface, exploiting user trust in the shared album feature.

Technical ContextAI

The vulnerability exists in the shared album functionality of Immich's api.service.ts file, where the album name parameter is directly inserted into an HTML <meta property="og:title"> tag without sanitization or encoding. Attackers exploit HTML attribute injection by crafting album names containing the sequence '0;url=https://attackersite.com" http-equiv="refresh', which breaks out of the og:title attribute and injects a meta refresh tag that forces browser redirection. This is a variant of XSS (CWE-79: Improper Neutralization of Input During Web Page Generation) that achieves redirection rather than script execution. The vulnerability affects the self-hosted photo/video management platform Immich across all versions prior to 2.7.3.

RemediationAI

Upgrade Immich to version 2.7.3 or later immediately, which includes HTML encoding of the album name parameter before insertion into meta tags. Organizations unable to upgrade immediately should implement HTML input validation and output encoding at the application layer, or deploy a Web Application Firewall (WAF) rule that blocks album names containing meta refresh injection patterns (specifically, strings matching '0;url=' or 'http-equiv='). Additionally, disable the Open Graph meta tag generation for shared albums until patching is completed, though this removes social media preview functionality. The primary mitigation is patching, as no vendor-endorsed workarounds exist beyond these stopgap measures. See GitHub advisory at https://github.com/immich-app/immich/security/advisories/GHSA-24fq-72x8-v7hm for patch details.