CVE-2026-53662

immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.

• CWE-79
• CWE-601

• https://github.com/immich-app/immich/commit/4eb100327ea5da2e90381b96809f1f1cc51cc7e3
• https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c
• https://github.com/immich-app/immich/security/advisories/GHSA-8244-8vpr-vp9c

Published

Jun 23, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5365The LatePoint plugin for WordPress is vulnerable to Cross-Si…4.3
• CVE-2026-53653Grav is a file-based Web platform. Prior to 1.7.53 and 2.0.0…8.7
• CVE-2026-53655node-tar is a full-featured Tar for Node.js. Prior to 7.5.16…5.5
• CVE-2026-53657Lima launches Linux virtual machines, typically on macOS, fo…8.2
• CVE-2026-5366Prefect version 3.6.23 is vulnerable to remote code executio…9.9
• CVE-2026-53661Boruta is a standalone authorization server that aims to imp…8.8
• CVE-2026-53663React Router is a router for React. From 7.12.0 until 7.15.1…3.1
• CVE-2026-53666React Router is a router for React. In versions 6.4.0 throug…6.1
• CVE-2026-53667React Router is a router for React. In versions 7.11.0 throu…6.1
• CVE-2026-53668React Router is a router for React. In versions 6.30.2 throu…6.9
• CVE-2026-53669React Router is a router for React. Versions 6.0.0 through 7…6.1
• CVE-2026-5367A flaw was found in OVN (Open Virtual Network). A remote att…8.6