Credential phishing via shared-album meta-tag injection

Open redirect in Immich before 2.7.3 allows remote authenticated users to redirect share-link visitors to an attacker-controlled site. The shared-album renderer in api.service.ts inserts the attacker-controlled album name into the content attribute of an og:title meta tag without HTML-attribute encoding, so an injected quote creates an http-equiv refresh directive. Exploitation requires a registered account to create and share the album and a victim to open its share link; the resulting redirect supports credential phishing but does not itself expose stored credentials.