immich-app/immich
1
0
Fork 0
mirror of https://github.com/immich-app/immich.git synced 2026-07-25 14:00:45 +03:00
Code Issues 783 Packages Projects Releases 22 Wiki Activity

Enabling OAuth causes Immich to ignore / bypass "Require user to change password on first login" parameter #7660

New Issue
Open
opened 2026-02-05 13:12:22 +03:00 by OVERLORD · 0 comments
OVERLORD commented 2026-02-05 13:12:22 +03:00
Owner
Copy Link

Originally created by @felinusfish on GitHub (Oct 30, 2025).

I have searched the existing issues, both open and closed, to make sure this is not a duplicate report.

  • Yes

The bug

When enabling OAuth and setting it up to Auto Launch, the user bypasses the new password requirement. This means that, worst case scenario if an email is compromised and password login is enabled, an intruder could gain access to personal data depending on how Immich is exposed to the internet.

The OS that Immich Server is running on

Debian 12 LXC

Version of Immich Server

v2.1.0

Version of Immich Mobile App

2.1.0 build.3022

Platform with the issue

  • Server
  • Web
  • Mobile

Device make and model

No response

Your docker-compose.yml content

Not relevant

Your .env content

Not relevant

Reproduction steps

  1. Set up OAuth authentication on the server.
  2. Enable Auto Launch.
  3. Attempt to log into a new account that has the "Require user to change password on first login" parameter.
  4. Enter the account, and you will not see the prompt.

Relevant log output

Additional information

No response

Originally created by @felinusfish on GitHub (Oct 30, 2025). ### I have searched the existing issues, both open and closed, to make sure this is not a duplicate report. - [x] Yes ### The bug When enabling OAuth and setting it up to Auto Launch, the user bypasses the new password requirement. This means that, worst case scenario if an email is compromised and password login is enabled, an intruder could gain access to personal data depending on how Immich is exposed to the internet. ### The OS that Immich Server is running on Debian 12 LXC ### Version of Immich Server v2.1.0 ### Version of Immich Mobile App 2.1.0 build.3022 ### Platform with the issue - [x] Server - [ ] Web - [ ] Mobile ### Device make and model _No response_ ### Your docker-compose.yml content ```YAML Not relevant ``` ### Your .env content ```Shell Not relevant ``` ### Reproduction steps 1. Set up OAuth authentication on the server. 2. Enable Auto Launch. 3. Attempt to log into a new account that has the "Require user to change password on first login" parameter. 4. Enter the account, and you will not see the prompt. ### Relevant log output ```shell ``` ### Additional information _No response_
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
accessibility
changelog:enhancement
changelog:security
changelog:skip
changelog:translation
cli
date-time
dependencies
documentation
external-library
format
good first issue
mobile-beta
mobile-beta
mobile-beta
needs-answer
nice to have
pull-request
Mirrored from GitHub Pull Request
 sharing
tech-debt
📱mobile
🖥️web
🗄️server
🧠machine-learning
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: immich-app/immich#7660
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?