CVE-2026-53662

{
  "id": "CVE-2026-53662",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T18:18:05.530",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003."
    },
    {
      "lang": "es",
      "value": "immich es una solución de alto rendimiento autoalojada para gestión de fotos y videos. Desde el commit 4ffa26c9 hasta el 4eb1003, una vulnerabilidad de cross-site scripting (XSS) reflejado en la página /auth/login permite a un atacante comprometer completamente la cuenta de cualquier usuario autenticado con un solo clic en un enlace. El parámetro de consulta continue se lee de la URL y se pasa a redirect() de SvelteKit sin ninguna validación de esquema u origen, permitiendo que JavaScript controlado por el atacante se ejecute dentro del origen de Immich. La carga útil luego utiliza la sesión existente de la víctima para generar una clave API con todos los permisos en su cuenta, lo que lleva a una toma de control persistente de la cuenta. Esta vulnerabilidad está corregida en el commit 4eb1003."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "immich-app",
          "product": "immich",
          "versions": [
            {
              "version": ">= main@4ffa26c9, < main@4eb1003",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T18:28:22.156497Z",
          "id": "CVE-2026-53662",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}