immich up to 1.131.x /user-settings incorrect implementation of authentication algorithm

Summaryinfo

A vulnerability classified as critical was found in immich up to 1.131.x. This vulnerability affects unknown code of the file /user-settings. The manipulation results in incorrect implementation of authentication algorithm. This vulnerability is identified as CVE-2025-43856. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in immich up to 1.131.x. It has been classified as critical. Affected is an unknown function of the file /user-settings. The manipulation with an unknown input leads to a incorrect implementation of authentication algorithm vulnerability. CWE is classifying the issue as CWE-303. The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

immich is a high performance self-hosted photo and video management solution. Prior to 1.132.0, immich is vulnerable to account hijacking through oauth2, because the state parameter is not being checked. The oauth2 state parameter is similar to a csrf token, so when the user starts the login flow this unpredictable token is generated and somehow saved in the browser session and passed to the identity provider, which will return the state parameter when redirecting the user back to immich. Before the user is logged in that parameter needs to be verified to make sure the login was actively initiated by the user in this browser session. On it's own, this wouldn't be too bad, but when immich uses the /user-settings page as a redirect_uri, it will automatically link the accounts if the user was already logged in. This means that if someone has an immich instance with a public oauth provider (like google), an attacker can - for example - embed a hidden iframe in a webpage or even just send the victim a forged oauth login url with a code that logs the victim into the attackers oauth account and redirects back to immich and links the accounts. After this, the attacker can log into the victims account using their own oauth credentials. This vulnerability is fixed in 1.132.0.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-43856 since 04/17/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

Upgrading to version 1.132.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-21169). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• immich

Version

• 1.131

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion