CVE-2025-64716

Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode

CVSS 5.1 MEDIUMEPSS 0.5%CWE-601 CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

13 Nov 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to `javascript:` URLs, it could still trigger dangerous behavior in some cases. Anybody with a subrequest authentication may be affected. Version 1.23.0 contains a fix for the issue.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Affected products

TecharoHQ · anubis

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/TecharoHQ/anubis/commit/7ed1753fcced351c81961bf520a7bfb2caac6e88 https://github.com/TecharoHQ/anubis/security/advisories/GHSA-cf57-c578-7jvv https://pkg.go.dev/vuln/GO-2025-4086