CVE-2025-64716

MediumCVSS 5.1

Published: 13/11/2025(UTC)Updated: 07/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.52%

42th percentile - higher than 42% of all known CVEs

Summary

Anubis, a Web AI Firewall Utility, prior to version 1.23.0 did not validate the redirect URL when using subrequest authentication, allowing redirection to any URL scheme. While most modern browsers block redirects to `javascript:` URLs, it could still trigger dangerous behavior in some cases. The issue is fixed in version 1.23.0.

Risk Assessment

Anyone using subrequest authentication may be redirected to dangerous URLs, which in some browsers could lead to malicious code execution or other harmful behavior.

Recommendation

Upgrade Anubis to version 1.23.0, which contains a fix for this issue.

Other vulnerabilities in Anubis

CVE-2026-62314Medium
A vulnerability in Anubis Web AI Firewall Utility from version 1.22.0 to 1.26.0-pre1 allows an attacker to bypass the Anubis challenge by manipulating the X-Original-URI header. The PathChecker.Check() function trusted the client-controlled header before matching r.URL.Path, enabling the use of ALLOW rules for patterns like ^/\.well-known/.*$.

Original NVD description (English source)

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to `javascript:` URLs, it could still trigger dangerous behavior in some cases. Anybody with a subrequest authentication may be affected. Version 1.23.0 contains a fix for the issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS