GHSA-6WCG-MQVH-FCVG Anubis: Policy bypass via client controlled X-Original-URI header

Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 introduced in commit d1d631a, PR 1015 The root cause is in lib/policy/checker.go, PathChecker.Check: go func...

Anubis: Policy bypass via client controlled X-Original-URI header

Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 introduced in commit d1d631a, PR 1015 The root cause is in lib/policy/checker.go, PathChecker.Check: go func...

CVE-2026-62314: Improper Access Control

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. From 1.22.0 until 1.26.0-pre1, lib/policy/checker.go PathChecker.Check trusted the client-controlled X-Original-URI header before matching r.URL.Path, allowing an HTTP...