Open Redirect Vulnerability in Immich Photo Management Solution

CVE-2026-40096

What is CVE-2026-40096?

Immich is a high-performance, self-hosted photo and video management solution that has a vulnerability affecting versions prior to 2.7.3. This open redirect issue exists within the shared album functionality, allowing attackers to exploit it by crafting a specially formatted album name that is inserted unsanitized into a tag. When users access the shared link, the renders the malicious code, redirecting the victim's browser to a site controlled by the attacker. This could lead to significant security risks, as unsuspecting users may be misled into providing login credentials on a fraudulent site designed to mimic the Immich interface. Users are encouraged to update to version 2.7.3 or later to mitigate this risk.

References