CVE-2026-126757

A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-601

• https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh
• https://vuldb.com/cve/CVE-2026-126757
• https://vuldb.com/submit/1033259
• https://vuldb.com/vuln/435867
• https://vuldb.com/vuln/435867/cti

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12672Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-126720Rooxis RXR-12 Wi-Fi router contains an unauthenticated remot…
• CVE-2026-126722Rooxis RXR-12 Wi-Fi router contains an undocumented telnet b…
• CVE-2026-126723Rooxis RXR-12 Wi-Fi router contains an authenticated command…
• CVE-2026-126724Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 ba…
• CVE-2026-12673Liquidfiles versions before 4.2.12 are affected by a broken …5.9
• CVE-2026-126758A vulnerability was detected in Moonshot AI Kimi Code up to …4.4
• CVE-2026-126759A flaw has been found in H3C ICG2000 Unified Communication G…5.3
• CVE-2026-126766OpsTree REMS through 1.0.0 contains an improper authorizatio…4.3
• CVE-2026-126767OpsTree REMS through 1.0.0 contains a prompt injection vulne…4.3
• CVE-2026-126768OpsTree REMS through 1.0.0 contains an authentication bypass…9.8
• CVE-2026-126769OpsTree REMS through 1.0.0 contains a missing authentication…7.5