CVE-2026-126757 | Moonshot AI Kimi Code up to 2.5.2 Web UI index-HU0LCM-X.js isOriginAllowed kimi_origin redirect

November 11, 2026 Yanac

A vulnerability was found in Moonshot AI Kimi Code up to 2.5.2 and classified as problematic. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect.

This vulnerability is documented as CVE-2026-126757. The attack can be executed remotely. Additionally, an exploit exists.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More