---
id: CVE-2025-64716
title: >-
  Anubis is a Web AI Firewall Utility that challenges users' connections in
  order to protect upstream resources from scraper bots
summary: >-
  Anubis is a Web AI Firewall Utility that challenges users' connections in
  order to protect upstream resources from scraper bots. Prior to version
  1.23.0, when using subrequest authentication, Anubis did not perform
  validation of the redi…
severity: none
cwe:
  - CWE-79
  - CWE-601
published: '2025-11-13'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-64716'
references:
  - url: >-
      https://github.com/TecharoHQ/anubis/commit/7ed1753fcced351c81961bf520a7bfb2caac6e88
    label: security-advisories@github.com
  - url: >-
      https://github.com/TecharoHQ/anubis/security/advisories/GHSA-cf57-c578-7jvv
    label: security-advisories@github.com
  - url: 'https://pkg.go.dev/vuln/GO-2025-4086'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00522
epssPercentile: 0.42443
ingestedAt: '2026-10-07T21:54:15.018Z'
---

## Overview

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to `javascript:` URLs, it could still trigger dangerous behavior in some cases. Anybody with a subrequest authentication may be affected. Version 1.23.0 contains a fix for the issue.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.