CVE-2026-53662: Immich Self-Hosted Photo App XSS Flaw

CVE-2026-53662 Overview

CVE-2026-53662 is a reflected cross-site scripting (XSS) vulnerability in Immich, a self-hosted photo and video management platform. The flaw exists on the /auth/login page, where the continue query parameter is passed directly to SvelteKit's redirect() function without scheme or origin validation. An attacker can craft a malicious link that executes JavaScript within Immich's origin when an authenticated user clicks it. The injected payload then leverages the victim's session to create an all-permission API key, resulting in persistent account takeover. The vulnerability affects builds from commit 4ffa26c9 up to commit 4eb1003, where it was patched.

Critical Impact
A single click on an attacker-crafted link enables full account takeover of any authenticated Immich user through API key creation.

Affected Products

Immich self-hosted photo and video management server
Builds from commit 4ffa26c9 through builds prior to commit 4eb1003
Immich web frontend (web/src/routes/auth/login/+page.ts)

Discovery Timeline

2026-06-23 - CVE-2026-53662 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-53662

Vulnerability Analysis

The vulnerability resides in the Immich web client's login route handler. When a user visits /auth/login, the loader reads the continue query parameter from the URL and passes it directly to SvelteKit's redirect(307, continueUrl). SvelteKit's redirect() honors absolute URLs and non-HTTP schemes such as javascript:, enabling script execution within the Immich origin context.

Because the payload runs same-origin, it inherits the victim's authenticated session cookie. The attacker's JavaScript then calls the Immich API to mint a new API key with all permissions on the victim's account. The key persists beyond session expiration, granting durable access to photos, videos, and account controls. This is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is missing validation of user-controlled redirect targets. The continueUrl value derived from the URL search parameters was trusted as a same-origin relative path, but no check enforced that it began with a single / or used a permitted scheme. Both protocol-relative URLs (//attacker.tld) and dangerous schemes (javascript:) bypassed the implicit assumption.

Attack Vector

Exploitation requires the victim to click a crafted link such as https://immich.example.com/auth/login?continue=javascript:.... When the authenticated user lands on the login page, SvelteKit issues the redirect to the attacker-controlled URI, executing the payload in Immich's origin and triggering API key creation.

typescript

// Patch in web/src/lib/route.ts
// queues
queues: () => '/admin/queues',
viewQueue: ({ name }: { name: QueueName }) => `/admin/queues/${asQueueSlug(name)}`,

// continue helper for ensuring same-origin URLs
continue: (url: string | null, fallback: string) => {
  if (!url || !url.startsWith('/') || url.startsWith('//')) {
    return fallback;
  }

  return url;
},

Source: GitHub Commit 4eb1003

typescript

// Patch in web/src/routes/auth/login/+page.ts
export const load = (async ({ parent, url }) => {
  await parent();

  const continueUrl = Route.continue(url.searchParams.get('continue'), Route.photos());

  if (authManager.authenticated) {
    redirect(307, continueUrl);
  }

The patch routes the continue parameter through a helper that rejects any value not starting with a single /, neutralizing both protocol-relative URLs and non-HTTP schemes. Source: GitHub Commit 4eb1003

Detection Methods for CVE-2026-53662

Indicators of Compromise

Inbound requests to /auth/login containing a continue parameter whose value does not start with a single / (for example, continue=javascript:, continue=//, or continue=https://).
Unexpected API key creation events in Immich audit logs, particularly keys granting full permissions shortly after a login event.
Outbound API calls from user sessions immediately following a redirect from /auth/login to a non-relative target.

Detection Strategies

Inspect web server and reverse proxy access logs for continue query values containing : or starting with //.
Alert on creation of API keys with all-permission scope, especially when the source IP or user-agent differs from prior account activity.
Correlate referrer headers pointing to external domains with subsequent /auth/login visits and API key creation.

Monitoring Recommendations

Forward Immich application and reverse proxy logs to a centralized log platform and retain login URLs with full query strings.
Track API key lifecycle events (create, list, delete) per user and baseline normal behavior for anomaly detection.
Monitor for spikes in authenticated requests originating from a single API key across unusual endpoints.

How to Mitigate CVE-2026-53662

Immediate Actions Required

Upgrade Immich to a release containing commit 4eb1003 or later without delay.
Audit the API keys table for every user account and revoke keys that were not provisioned by the legitimate owner.
Invalidate active sessions and require users to re-authenticate after upgrading.
Notify users to inspect their account for unfamiliar API keys and shared albums.

Patch Information

The fix is delivered in commit 4eb100327ea5da2e90381b96809f1f1cc51cc7e3, which introduces a Route.continue() helper that enforces same-origin relative paths and rejects protocol-relative or scheme-based URLs. Details are available in the GitHub Security Advisory GHSA-8244-8vpr-vp9c and the upstream commit.

Workarounds

Place Immich behind a reverse proxy and reject any request to /auth/login whose continue parameter does not begin with a single /.
Restrict Immich access to authenticated VPN users to reduce the attack surface from untrusted link clicks.
Strip or normalize the continue query parameter at the proxy layer until the upgrade is complete.

bash

# Example NGINX rule to block dangerous continue values
if ($arg_continue ~* "^(javascript:|data:|//|https?:)") {
    return 400;
}