CVE-2026-62314

Name of the Vulnerable Software and Affected Versions Anubis versions 1.22.0 through 1.26.0-pre1

Description Anubis is a Web AI Firewall Utility designed to protect upstream resources from scraper bots by challenging user connections. A flaw exists in the PathChecker.Check() function within lib/policy/checker.go where the utility trusts the client-controlled X-Original-URI header before matching r.URL.Path. This allows an HTTP client to match default ALLOW rules, such as ^/.well-known/.*$, and bypass the Anubis challenge.

Recommendations Update Anubis to version 1.26.0-pre1.