immich -- open redirect and reflected XSS in maintenance endpoint

The immich project reports:

The /maintenance endpoint fails to validate the continue URL parameter. When maintenance mode is disabled, which is the default, the application accepts unvalidated redirect targets, enabling both open redirects and reflected cross-site scripting. An unauthenticated user can craft a malicious link leading to account takeover, including administrative accounts, through same-origin API requests with credentials.

[source]