Read the docs
TI-2025-40062 Aliases CVE-2025-64716GHSA-cf57-c578-7jvv

Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode

Priority LOW 24CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Spoofing, Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601 and CWE-79.

Summary

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to `javascript:` URLs, it could still trigger dangerous behavior in some cases. Anybody with a subrequest authentication may be affected. Version 1.23.0 contains a fix for the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0043 37th percentileScored 2026-11-07
Fix Fixed anubis (TecharoHQ): 1.23.0github.com/TecharoHQ/anubis (Go): 1.23.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TecharoHQanubisbefore 1.23.01.23.0Patch availableCNA
—github.com/TecharoHQ/anubis (Go)before 1.23.01.23.0Patch availableGHSA-cf57-c578-7jvv
  • anubis VendorTecharoHQ Affected before 1.23.0 Fixed in 1.23.0 Patch available CNA
  • github.com/TecharoHQ/anubis (Go) Vendor— Affected before 1.23.0 Fixed in 1.23.0 Patch available GHSA-cf57-c578-7jvv

Remediation

  • Fix · CNA anubis (TecharoHQ) Fixed in 1.23.0
  • Fix · GHSA-cf57-c578-7jvv github.com/TecharoHQ/anubis (Go) Fixed in 1.23.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-64716
  2. 2026-10-03 Alias added: GHSA-cf57-c578-7jvv

References

Advisory 1

Other 4

  • TI-2026-44491 Anubis: Policy bypass via client controlled X-Original-URI header CVSS 3.1MEDIUM 5.8
  • TI-2025-34220 Anubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences