CVE-2026-62314: TecharoHQ Anubis firewall challenge bypass via X-Original-URI header

Executive brief

Anubis, a web firewall designed to block automated scraper bots, contains a flaw that allows attackers to bypass its security challenges. By sending a specially crafted web request with a specific header, an attacker can trick the system into thinking the request is for a pre-approved path (like a system health check). This allows bots or unauthorized users to access protected resources without being blocked or challenged by the firewall.

Technical details

Anubis (versions 1.22.0 to 1.26.0-pre1) contains an improper access control vulnerability in its path-checking logic. The `PathChecker.Check()` function in `lib/policy/checker.go` prioritizes the client-provided `X-Original-URI` header over the actual `r.URL.Path` when evaluating access rules. An unauthenticated remote attacker can exploit this by providing a header value that matches default 'ALLOW' rules (e.g., `^/\.well-known/.* ), effectively bypassing the Anubis bot challenge for any target path. The issue is resolved in version 1.26.0-pre1 by correctly handling subrequest mode and validating headers.

Affected products

• TecharoHQ Anubis >= 1.22.0, < 1.26.0-pre1

Timeline

• 2026-05-14: patched: Fix committed to repository
• 2026-06-26: advisory: Pre-release v1.26.0-pre1 published
• 2026-07-15: disclosed: CVE published to NVD

References

• https://github.com/TecharoHQ/anubis/commit/276b537776b281b1c4e01421435bc03ade3d8fc4
• https://github.com/TecharoHQ/anubis/pull/1630
• https://github.com/TecharoHQ/anubis/releases/tag/v1.26.0-pre1
• https://github.com/TecharoHQ/anubis/security/advisories/GHSA-6wcg-mqvh-fcvg