immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting (XSS) vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The continue query parameter is read from the URL and passed to SvelteKit's redirect() without any scheme or origin validation, allowing attacker-controlled JavaScript to execute inside Immich's origin. The payload then uses the victim's existing session to mint an all-permission API key on their account, leading to persistent account takeover. This vulnerability is fixed in commit 4eb1003.
The query parameter 'continue' read from the login page URL is passed directly to the SvelteKit framework's redirect() function without any schema or origin validation. This allows the attacker to embed malicious JavaScript code in this parameter, which is executed in the context of the Immich application's origin. The payload executed in the victim's browser uses their existing session to automatically generate an API key with full permissions on their account, resulting in permanent account takeover even after logout.
The attacker gains full control over the victim's account by generating a permanent API key with all permissions, resulting in unauthorized access to all stored photos and videos and the ability to continue operating independently of the victim's session.
Update Immich to a version containing commit 4eb100327ea5da2e90381b96809f1f1cc51cc7e3 or newer, which introduces schema and origin validation for the 'continue' parameter. Details are available in the vendor references (GitHub Security Advisory GHSA-8244-8vpr-vp9c).
Immich application in versions based on commits from 4ffa26c9 to (excluding) 4eb1003
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H