Credential Disclosure Vulnerability in Immich Photo Management Solution

CVE-2026-25118

What is CVE-2026-25118?

The Immich photo and video management application has a critical flaw that leads to credential disclosure during the user authentication process to shared albums. Prior to version 2.6.0, the application mistakenly transmits album passwords through URL query parameters as part of a GET request. This design flaw makes sensitive data visible in browser histories, server logs, and referrer headers, significantly increasing the risk of unauthorized access to shared albums and sensitive user information. Version 2.6.0 addresses this issue, reinforcing the necessary security measures to protect user credentials.

References