Can you explain this vulnerability to me?

This vulnerability in immich (prior to version 1.132.0) involves account hijacking through the oauth2 login flow because the state parameter, which acts like a CSRF token, is not being checked. The state parameter should be verified to ensure the login was initiated by the user in the current browser session. However, immich uses the /user-settings page as a redirect URI, which automatically links accounts if the user is already logged in. An attacker can exploit this by sending a forged oauth login URL or embedding a hidden iframe that logs the victim into the attacker's oauth account and links it to the victim's immich account. This allows the attacker to later log into the victim's account using their own oauth credentials. The issue is fixed in immich version 1.132.0.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability can lead to account hijacking, where an attacker can gain unauthorized access to a victim's immich account by linking their own oauth credentials to the victim's account. This compromises the victim's personal photo and video data managed by immich, potentially leading to data theft, privacy breaches, and unauthorized account control.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

The immediate step to mitigate this vulnerability is to upgrade immich to version 1.132.0 or later, where the issue with the oauth2 state parameter not being checked is fixed.

Useful 0 Not Useful 0