CVE-2025-64716

MediumCVSS 5.1/10Last modified Oct 7, 2026

Description

Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when using subrequest authentication, Anubis did not perform validation of the redirect URL and redirects user to any URL scheme. While most modern browsers do not allow a redirect to `javascript:` URLs, it could still trigger dangerous behavior in some cases. Anybody with a subrequest authentication may be affected. Version 1.23.0 contains a fix for the issue.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79 CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2025
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-647179.8ZITADEL is an open source identity management platform. Starting in version 2.50.0 and prior to versions 2.71.19, 3.4.4, and 4.6.6, a vulner CVE-2025-647185.3js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of CVE-2025-647194.9Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki p CVE-2025-64729.8A vulnerability, which was classified as critical, has been found in code-projects Online Bidding System 1.0. Affected by this issue is some CVE-2025-647207.1LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. CVE-2025-6472110.0Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the CVE-2025-647234.4Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive se CVE-2025-647247.3Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file pe CVE-2025-647259.8Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Ver CVE-2025-647267.3Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous CVE-2025-647298.2The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project file CVE-2025-64736.1A vulnerability, which was classified as problematic, was found in code-projects School Fees Payment System 1.0. This affects an unknown par