EUVD-2026-38551Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Network-reachable login page (AV:N), no auth to send the link (PR:N), victim click required (UI:R), XSS in Immich origin escapes login-page scope (S:C) and API-key minting yields full C/I/A.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.
AnalysisAI
Reflected cross-site scripting in Immich (commits 4ffa26c9 through pre-4eb1003) allows a single-click account takeover of any authenticated user by abusing the unvalidated continue query parameter on /auth/login, which is passed directly to SvelteKit's redirect() without scheme or origin checks. The payload executes attacker-controlled JavaScript inside Immich's origin and uses the victim's session to mint an all-permission API key, yielding persistent compromise. No public exploit identified at time of analysis, but the upstream fix commit and a detailed GHSA advisory describe the flaw clearly enough to derive a working PoC.
Technical ContextAI
Immich is a self-hosted photo and video management platform whose web frontend is built on SvelteKit. The vulnerability is a textbook CWE-79 (Improper Neutralization of Input During Web Page Generation) realized through an open-redirect-to-XSS pattern: web/src/routes/auth/login/+page.ts read url.searchParams.get('continue') and handed it straight to SvelteKit's redirect() helper. SvelteKit's redirect() accepts arbitrary URL strings including javascript: and protocol-relative (//evil.tld) values, so without scheme/origin validation an attacker-controlled URL is dereferenced in the same-origin context of the login page. The CPE cpe:2.3:a:immich-app:immich:*:*:*:*:*:*:*:* covers all Immich web builds containing the vulnerable route between commit 4ffa26c9 and the fix 4eb1003. The patch adds a Route.continue() helper in web/src/lib/route.ts that only permits values starting with '/' and not '//', and applies it to both the login and pin-prompt flows.
RemediationAI
Upstream fix available (commit 4eb100327ea5da2e90381b96809f1f1cc51cc7e3); update Immich to any build that includes this commit per the vendor advisory at https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c. The fix introduces a Route.continue() helper that rejects continue values not beginning with a single '/', and applies it to both /auth/login and /auth/pin-prompt. If you cannot upgrade immediately, place Immich behind a reverse proxy that strips or sanitizes the continue query parameter on /auth/login and /auth/pin-prompt (for example by dropping any continue value not matching ^/[^/] in nginx or Caddy), and consider tightening the Content-Security-Policy to forbid inline script and javascript: URLs - the trade-off is that the parameter is then non-functional, so users will lose deep-link-after-login behavior. Revoking and rotating any API keys created during the exposure window is also recommended, since the exploit primitive is exactly to mint an attacker-controlled key.
Immich versions prior to 2.5.0 contain an improper access control flaw that allows any authenticated API key to escalate
Album ownership takeover in immich before 3.0.3 allows a user with shared-album editor access to escalate to full owner
Locked asset visibility bypass in Immich through 3.1.0 exposes private photo and video assets to unauthorized viewers vi
Immich prior to version 2.6.0 discloses shared album passwords in cleartext within URL query parameters during authentic
Stored Cross-Site Scripting in Immich photo management platform versions prior to 2.7.0 enables authenticated attackers
Open redirect vulnerability in Immich prior to version 2.7.3 allows authenticated attackers to craft malicious shared al
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today