Threats tagged 'ghsa-cf57-c578-7jvv'

Anubis versions prior to 1.23.0 are vulnerable to a potential cross-site scripting (XSS) issue via the 'redir' parameter when using subrequest authentication mode. The application does not validate redirect URLs, allowing redirection to arbitrary URL schemes, including potentially dangerous ones like 'javascript:'. Although most modern browsers block such redirects, some custom protocols could still be exploited. This vulnerability was reported by a third party and fixed in version 1.23.0.