CVE-2026-53662 immich: One-click account takeover via XSS in login page continue redirect
Reflected XSS in the login page allows attackers to execute JavaScript and steal API keys, leading to full account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-53662?
CVE-2026-53662 is a critical cross-site scripting vulnerability in immich-app immich, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.
Which versions are affected by CVE-2026-53662?
How do I fix CVE-2026-53662?
No fix has been published for CVE-2026-53662 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-53662 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53662 exists.
Sources
Also known as GHSA-8244-8vpr-vp9c.