Immich EUVD-2026-38551

Victim must already be authenticated to a vulnerable Immich instance (commit range 4ffa26c9 to pre-4eb1003) and must click an attacker-supplied link pointing at /auth/login with a malicious continue query parameter (UI:R in the CVSS vector). No attacker authentication is required (PR:N), no special server configuration is needed - the vulnerable code path is on the default login route - and the Immich web UI must be reachable by the victim's browser. Exploitation is limited to users with active sessions; an unauthenticated visitor would only experience a redirect/XSS without the API-key-minting takeover impact.

All severity signals point in the same direction: CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H (9.6 Critical) reflects unauthenticated network-reachable exploitation requiring only that an already-authenticated victim click a link, with a scope change because the XSS executes in Immich's origin and yields full account control via API-key minting. Real-world impact is high because Immich instances are typically internet-reachable (self-hosted media servers behind reverse proxies) and the attacker chain converts a transient XSS into a persistent all-permission API key - a true account takeover, not just session theft. KEV status is NO and POC=NO, so this is not yet on CISA's actively-exploited list and no EPSS value was provided in the input, but the GHSA advisory plus a public patch commit make weaponization trivial for any researcher. No conflicting signals in the data; the main uncertainty is real-world exploitation prevalence, which is unknown.

An attacker sends a target Immich user a chat message or email containing a link such as https://immich.example.com/auth/login?continue=javascript:fetch('/api/api-keys',{method:'POST',...}); the victim, already logged in, clicks the link, the login page hands the continue value to SvelteKit's redirect(), and the javascript: URL executes in Immich's origin. The payload calls the API-key endpoint with the victim's session cookie to create an all-permission key, exfiltrates it to the attacker, and the attacker now has persistent backend access independent of the victim's session.