CVE-2026-62314: Anubis: Policy bypass via client controlled X-Original-URI header

Any HTTP client can bypass Anubis bot protection on the default configuration by adding a single request header. No challenge needs to be solved. Affected versions: v1.22.0 through v1.25.0 (introduced in commit d1d631a, PR #1015)

The root cause is in lib/policy/checker.go, PathChecker.Check():

func (pc *PathChecker) Check(r *http.Request) (bool, error) {
originalUrl := r.Header.Get("X-Original-URI")
if originalUrl != "" {
if pc.regexp.MatchString(originalUrl) {
return true, nil
}
}
if pc.regexp.MatchString(r.URL.Path) {
return true, nil
}
return false, nil
}

The header value comes directly from the client request. The middleware chain never strips it. In reverse proxy mode an attacker fully controls it. The default policy imports data/common/keep-internet-working.yaml, which contains path-only ALLOW rules with no other conditions:

- name: well-known
path_regex: ^/\.well-known/.*$
action: ALLOW

When X-Original-URI matches one of those regexes, the rule fires as ALLOW and the request is forwarded upstream without any challenge or JWT check.