CVE-2026-53662

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53662", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T20:50:36.877Z", "datePublished": "2026-06-23T17:36:30.727Z", "dateUpdated": "2026-06-23T18:32:43.755Z"}, "containers": {"cna": {"title": "immich: One-click account takeover via XSS in login page continue redirect", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c"}, {"name": "https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3", "tags": ["x_refsource_MISC"], "url": "https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3"}], "affected": [{"vendor": "immich-app", "product": "immich", "versions": [{"version": ">= main@4ffa26c9, < main@4eb1003", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T17:36:30.727Z"}, "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003."}], "source": {"advisory": "GHSA-8244-8vpr-vp9c", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-23T18:28:22.156497Z", "id": "CVE-2026-53662", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T18:32:43.755Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53662", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-23T18:28:22.156497Z"}}}], "references": [{"url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T18:28:11.658Z"}}], "cna": {"title": "immich: One-click account takeover via XSS in login page continue redirect", "source": {"advisory": "GHSA-8244-8vpr-vp9c", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "immich-app", "product": "immich", "versions": [{"status": "affected", "version": ">= main@4ffa26c9, < main@4eb1003"}]}], "references": [{"url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c", "name": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3", "name": "https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-23T17:36:30.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53662", "state": "PUBLISHED", "dateUpdated": "2026-06-23T18:32:43.755Z", "dateReserved": "2026-06-09T20:50:36.877Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-23T17:36:30.727Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "immich", "vendor": "immich-app", "versions": [{"status": "affected", "version": ">= main@4ffa26c9, < main@4eb1003"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003."}, {"lang": "es", "value": "immich es una soluci\u00f3n de alto rendimiento autoalojada para gesti\u00f3n de fotos y videos. Desde el commit 4ffa26c9 hasta el 4eb1003, una vulnerabilidad de cross-site scripting (XSS) reflejado en la p\u00e1gina /auth/login permite a un atacante comprometer completamente la cuenta de cualquier usuario autenticado con un solo clic en un enlace. El par\u00e1metro de consulta continue se lee de la URL y se pasa a redirect() de SvelteKit sin ninguna validaci\u00f3n de esquema u origen, permitiendo que JavaScript controlado por el atacante se ejecute dentro del origen de Immich. La carga \u00fatil luego utiliza la sesi\u00f3n existente de la v\u00edctima para generar una clave API con todos los permisos en su cuenta, lo que lleva a una toma de control persistente de la cuenta. Esta vulnerabilidad est\u00e1 corregida en el commit 4eb1003."}], "id": "CVE-2026-53662", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53662", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-23T18:28:22.156497Z", "version": "2.0.3"}}]}, "published": "2026-06-23T18:18:05.530", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3"}, {"source": "security-advisories@github.com", "url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": ">= main@4ffa26c9, < main@4eb1003"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "immich", "source": "cna", "vendor": "immich-app"}, "product": "immich", "vendor": "immich-app"}], "created": "2026-06-23T21:30:07.304595+00:00", "updated": "2026-06-24T11:00:13.051960+00:00", "vendors": ["immich-app", "immich-app$PRODUCT$immich"]}