CVE-2026-53662: immich: One-click account takeover via XSS in login page continue redirect

Synopsis

Reflected cross-site scripting (XSS) in the login page of immich, a self-hosted photo and video management application, allows a remote unauthenticated attacker to execute attacker-controlled JavaScript inside the victim's browser by tricking them into clicking a crafted link. The vulnerable continue query parameter on the /auth/login route is passed to SvelteKit's redirect() without any scheme or origin validation, enabling script execution within immich's origin using the victim's active session. Successful exploitation gives the attacker persistent, full-permission API key access to the victim's account, constituting a complete account takeover. No fix version has been published yet; HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix ships.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious link over the network; the victim's browser must be able to reach the immich login page from a network-accessible instance.

• AuthenticationNot required

  No account or credentials are needed by the attacker; the crafted URL is constructed and distributed without any prior authentication.

• Victim interactionRequired

  The victim must click a specially crafted link that loads the malicious continue parameter on the /auth/login page, making this a social-engineering-dependent exploit.

• Attack complexityDetail

  Attack complexity is low; no race conditions, memory layout requirements, or special environmental conditions are needed to reliably trigger the XSS payload.

Blast Radius

• The attacker's injected script mints an all-permission API key using the victim's existing session, granting durable programmatic access to the account even after the victim logs out.
• The attacker reads all photos, videos, and metadata stored in the victim's immich library, exposing potentially sensitive personal media.
• The attacker modifies or deletes albums, shared links, and stored assets within the victim's account.
• The scope change (S:C in the CVSS vector) means the injected script executes within immich's origin and can interact with any resource or cookie scoped to that origin, extending impact beyond the immich application boundary if other services share the same domain.