CVE-2025-43856 Overview
Immich, a self-hosted photo and video management platform, contains an OAuth2 authentication flaw that allows attackers to hijack user accounts. The vulnerability affects all versions prior to 1.132.0 and stems from missing validation of the OAuth2 state parameter during the login flow. An attacker can force a victim's Immich account to link with an attacker-controlled OAuth identity, enabling later account takeover. The flaw is categorized as [CWE-303: Incorrect Implementation of Authentication Algorithm].
Critical Impact
Attackers can hijack Immich user accounts by tricking authenticated victims into linking attacker-controlled OAuth identities, granting persistent access to victim photo libraries.
Affected Products
- Immich self-hosted photo and video management server
- All Immich releases prior to version 1.132.0
- Deployments using public OAuth providers such as Google for authentication
Discovery Timeline
- 2025-07-11 - CVE-2025-43856 published to the National Vulnerability Database
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-43856
Vulnerability Analysis
The vulnerability resides in Immich's OAuth2 login handler, which fails to verify the state parameter returned by the identity provider. The state parameter functions as a Cross-Site Request Forgery (CSRF) token. It must be generated server-side, stored in the browser session, and compared against the value the identity provider echoes back. Skipping that comparison allows an attacker to initiate an OAuth flow and have the response accepted by a victim's browser session.
When Immich processes the OAuth callback at /user-settings while the victim is already authenticated to Immich, the application automatically links the returning OAuth identity to the active local account. Combining the missing state check with auto-linking turns the OAuth callback into an account-binding primitive controlled by the attacker.
Root Cause
The root cause is the absence of state parameter verification in the OAuth2 callback handler. Without binding the OAuth response to the originating browser session, Immich treats any well-formed callback as a legitimate login or link operation initiated by the current user.
Attack Vector
An attacker first completes an OAuth authorization request against the victim's Immich instance using their own attacker-owned identity provider account, obtaining an authorization code. The attacker then forces the victim's browser to issue the callback request, for example by embedding a hidden iframe pointing at the Immich callback URL with the attacker's code, or by sending a crafted link. If the victim is logged into Immich, the callback hits /user-settings, and Immich links the attacker's OAuth identity to the victim's account. The attacker then logs in to Immich using their own OAuth credentials and arrives in the victim's account.
The vulnerability is described in detail in the GitHub Security Advisory GHSA-3832-6r8h-9cfm.
Detection Methods for CVE-2025-43856
Indicators of Compromise
- Unexpected OAuth identity links appearing in Immich user account settings, particularly external identifiers the user did not authorize.
- Successful logins followed immediately by account setting changes originating from previously unseen IP addresses or user agents.
- OAuth callback requests to /user-settings lacking a matching session-bound state value in proxy or web server logs.
Detection Strategies
- Audit the Immich database for OAuth identity bindings added during the exposure window and reconcile them with user-reported activity.
- Inspect reverse proxy logs for callback requests where the Referer header does not match the Immich origin or where the request was triggered by an iframe.
- Correlate authentication events with subsequent media access patterns to identify accounts accessed from new sessions immediately after an OAuth link event.
Monitoring Recommendations
- Enable detailed authentication logging in Immich and forward events to a centralized logging or Security Information and Event Management (SIEM) platform.
- Alert on new OAuth identity link events outside of expected onboarding workflows.
- Track anomalous login geolocations or device fingerprints following account modification events.
How to Mitigate CVE-2025-43856
Immediate Actions Required
- Upgrade all Immich instances to version 1.132.0 or later without delay.
- Force a global session invalidation and require users to re-authenticate after upgrade.
- Review the OAuth identity bindings for every account and remove any unrecognized linked identities.
Patch Information
The maintainers fixed the issue in Immich 1.132.0 by validating the OAuth2 state parameter against the value stored in the browser session before processing the callback. Release notes and patch context are available in the Immich GitHub Security Advisory.
Workarounds
- If immediate upgrade is not possible, disable OAuth2 authentication in Immich and rely on local credentials until the patch is applied.
- Restrict access to the Immich web interface behind an authenticating reverse proxy or VPN to limit exposure to cross-origin callback abuse.
- Instruct users to log out of Immich before browsing untrusted sites to reduce the window where an attacker-forced callback would auto-link accounts.
# Configuration example: upgrade Immich via Docker Compose
# Update the image tag in docker-compose.yml to the fixed release
sed -i 's|immich-server:.*|immich-server:v1.132.0|' docker-compose.yml
docker compose pull
docker compose up -d
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
