A reflected cross‑site scripting flaw existed on the /auth/login page of immich between commit 4ffa26c9 and commit 4eb1003. The continue query parameter is forwarded to SvelteKit’s redirect() without scheme or origin validation, execute within Immich’s origin. Because the user is already authenticated, the malicious script can generate a full‑permission API key in the victim’s account, allowing a persistent takeover of that account with a single link click. This flaw has been fixed in commit 4eb1003. The weakness is represented by CWE‑79 (XSS) and CWE‑601 (Open Redirect).

The vulnerability affects the immich‑app:immich product. It was present between commit 4ffa26c9 and commit 4eb1003; updating to commit 4eb1003 or any later release removes the flaw. No specific versions are listed beyond this commit range.

The CVSS score of 9.6 indicates a critical severity. Although the EPSS score is not available, the absence of a KEV listing does not reduce the risk to an authenticated user. The likely attack vector requires an attacker to craft a link with a malicious continue parameter and persuade a victim user to click it. When executed, the payload runs with the victim’s session, allowing the attacker to generate a full‑permission API key and persistently take over the account. This vulnerability is exploitable with a single click, and the high severity combined with ease of exploitation makes the threat significant.