🚨 CRITICAL - Immich login reflected XSS via unvalidated redirect continue parameter (CVE-2026-53662) Immich contains a reflected XSS on the /auth/login page where the continue query parameter is passed into SvelteKit’s redirect() without validating scheme or origin. The root cause is improper input validation leading to an open redirect-to-JavaScript/reflected XSS condition. An attacker can exploit this by sending a crafted login link to a victim; once clicked, attacker-controlled JavaScript runs in Immich’s origin and can act with the victim’s authenticated session. Impact is severe: the payload can mint an all-permissions API key for persistent account takeover and long-term access even after the session ends. 👉 Affected: immich commits 4ffa26c9 through 4eb1003 | Upgrade to commit 4eb1003 (or later)
Post summary
The post discloses a critical reflected XSS vulnerability in Immich’s login flow and advises upgrading to commit 4eb1003 or later to patch the issue.