CVE-2026-53662: immich: One-click account takeover via XSS in login page continue redirect
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
immichto a version that resolves this vulnerability.Patch 4eb1003 - Operational
After upgrading immich to the fix commit 4eb1003, revoke any potentially attacker-minted all-permission API keys on affected accounts (payload uses the victim's existing session to mint an all-permission API key, leading to persistent takeover).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53662?
CVE-2026-53662 has a critical severity score of 9.6.
How do I fix CVE-2026-53662?
To fix CVE-2026-53662, update your Immich installation to the latest version that addresses this vulnerability.
What vulnerability type is CVE-2026-53662 classified as?
CVE-2026-53662 is classified as a reflected cross-site scripting (XSS) vulnerability.
What can an attacker do with CVE-2026-53662?
An attacker can fully compromise any authenticated user's account with a single link click due to CVE-2026-53662.
In which software is CVE-2026-53662 found?
CVE-2026-53662 is found in the Immich photo and video management solution.