Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing, Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-601 and CWE-80.
Summary
Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper bots. In versions 1.21.2 and below, attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript code or trigger other nonstandard schemes. An incomplete version of this fix was tagged at 1.21.2 and then the release process was aborted upon final testing. To work around this issue: block any requests to the /.within.website/x/cmd/anubis/api/pass-challenge route with the ?redir= parameter set to anything that doesn't start with the URL scheme http, https, or no scheme (local path redirect). This was fixed in version 1.21.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA anubis (TecharoHQ) Fixed in 1.21.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-54414
References
More TecharoHQ vulnerabilities
- TI-2026-44491 Anubis: Policy bypass via client controlled X-Original-URI header CVSS 3.1MEDIUM 5.8
- TI-2025-40062 Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode CVSS 4.0MEDIUM 5.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences