CVE Intelligence
Analysis AI-assisted

CVE-2026-53662: Immich reflected XSS on login page enabling account takeover

A reflected cross-site scripting flaw in the Immich login page (CWE-79) lets a crafted link run JavaScript in the application origin. The record states this can be used to create an all-permission API key on the victim's account, enabling persistent takeover. The advisory references a fix in commit 4eb1003, and CISA KEV does not list this CVE.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Immich is a self-hosted photo and video management application. According to the GitHub Security Advisory, the /auth/login page passes the continue parameter into a SvelteKit redirect without scheme or origin validation, which is classified as CWE-79 cross-site scripting.

Impact

The record describes a path from script execution in the Immich origin to creating an all-permission API key for the victim, which would persist after the session ends. The GitHub-provided CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H with a base score of 9.6, rated critical.

  • Confidentiality, integrity and availability are all rated high in the vector.
  • User interaction is required, specifically a single link click.

Affected products and versions

The structured record lists no affected version ranges. The description bounds the issue by commits 4ffa26c9 and 4eb1003, and mapping these commits to released versions is unknown from the sources consulted. Review the fix commit and the advisory for release details.

Exploitation status

CISA KEV does not list this CVE in the record. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Upgrade to a build that includes commit 4eb1003 or later. The record does not name a release version.
  • Until patched, limit exposure of the login page where feasible and avoid opening untrusted links while signed in to the instance.
  • Review API keys on accounts that may have followed unfamiliar links, and remove any key the owner does not recognize.
  • Rotate session credentials if compromise is suspected.

Detection guidance

  • Review access logs for requests to /auth/login with unusual continue values.
  • Review creation of API keys, especially keys with broad permissions, and correlate them with unexpected user activity.

Limitations of the available information

The record lacks an affected version list, a fixed release version, NVD-assessed CVSS data, EPSS and SSVC values, so these remain unknown. No additional workarounds beyond the fix commit are described.

Frequently asked questions

Does this vulnerability require any action from the victim?

According to the record, exploitation requires the victim to click a single crafted link while authenticated. Users should avoid untrusted links while signed in and keep the instance updated.

Is there a confirmed fix?

The record states the vulnerability is fixed in commit 4eb1003. It does not name a released version, so administrators should check the advisory for the release that includes the commit.

Is this vulnerability known to be exploited?

CISA KEV does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.