{"id":"CVE-2026-126757","kind":"vulnerability","aliases":["CVE-2026-126757"],"related":[],"title":"Kimi Code Web UI: crafted kimi_origin link can send API requests, bearer token included, to an attacker's site","description":"A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Kimi Code's Web UI honored a kimi_origin URL parameter on HTTP(S) pages. Per Moonshot's own PR #3964, a crafted link could redirect API requests, bearer token included, to an attacker-controlled origin. NVD frames it as an open redirect in isOriginAllowed, versions up to 2.5.2. The fix is described as landing in a separate repo (kimi-code-app#775) with the dist-web bundle synced later. No release note confirms it shipped, and 2.5.3 (2026-11-10) does not mention it.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"kimi-code","fixed":[],"affected":"<= 2.5.2","ecosystem":"npm"}],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","kimi-code","web-ui"],"not_affected_if":["cli-only-use"],"how_to_check":"- Run kimi --version; 2.5.2 and earlier are listed as affected by NVD. 2.5.3 is not confirmed fixed.\n- Check whether you start the Web UI (kimi web) and open links to it from untrusted sources.\n- Also check whether it is bound beyond loopback (--network or --host); the docs for the earlier kimi-cli say the default is 127.0.0.1.","fix":null,"status":"open","published_at":"2026-11-11T23:17:11+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","triaged_at":"2026-11-11T23:31:23+00:00","updated_at":"2026-11-11T23:32:26+00:00","category":"ai-tooling","confidence":0.65,"triage":{"at":"2026-11-11T23:31:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kimi Code: Web UI origin check lets attackers redirect users to other sites","impact":"low","summary":"Kimi Code, an AI coding agent from Moonshot AI, has a flaw in its Web UI where the kimi_origin parameter is not properly checked, enabling open redirects. An attacker can send a crafted link that sends a user to a site of the attacker's choosing.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["kimi-code","web-ui","ai-coding-agent"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"users are redirected to attacker-chosen sites for phishing","analyst_note":"Confirm whether the Web UI runs by default and find a fixed version; the sources give none and the vendor did not respond.","how_to_check":"- Check the installed Kimi Code version, and treat `2.5.2` and earlier as affected.\n- Check whether the Kimi Code Web UI is running and reachable from other machines.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["cli-only-use"],"who_is_affected":"Teams running the Kimi Code Web UI (versions up to 2.5.2) are exposed, since the flaw is in the Web UI's origin check. Installations that use only the command line and never start the Web UI are not reached by this flaw. The sources do not say whether a default install starts the Web UI.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4613,"output_tokens":547,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm whether the Web UI runs by default and find a fixed version; the sources give none and the vendor did not respond.","search":"'-10':126B '-11':125B '-126757':23A,26A '-2026':22A,25A '2.5.2':92B,143C '2.5.3':123B '2026':124B '3964':63B '775':107B 'affect':145C 'agent':33B 'ai':31B,35B,138C 'ai-coding-ag':30B 'ai-tool':34B 'api':11A,69B 'app':106B 'apps/kimi-code/dist-web/assets/index-hu0lcm-x.js':152C 'argument':162C 'attack':18A,77B,170C 'attacker-control':76B 'bearer':13A,71B 'bundl':113B 'code':2A,29A,32B,39B,44B,105B,140C 'compon':155C 'confirm':119B 'contact':188C 'control':78B 'could':67B 'craft':5A,65B 'cve':21A,24A 'describ':96B 'detect':135C 'disclos':179C 'disclosur':192C 'dist':111B 'dist-web':110B 'earli':189C 'execut':173C 'exploit':176C 'file':151C 'fix':94B 'frame':81B 'function':147C 'honor':48B 'http':55B 'includ':15A,73B 'isoriginallow':88B,148C 'kimi':1A,6A,28A,38B,43B,50B,104B,139C,163C 'kimi-cod':37B 'kimi-code':27A 'kimi-code-app':103B 'land':98B 'later':115B 'lead':165C 'link':8A,66B 'manipul':159C 'may':182C 'mention':129B 'moonshot':59B,137C 'note':118B 'nvd':80B 'open':85B,167C 'origin':7A,51B,79B,164C 'page':57B 'paramet':53B 'per':58B 'pr':62B 'public':180C 'redirect':68B,86B,168C 'releas':117B 'remot':174C 'repo':102B 'request':12A,70B 'respond':196C 'secur':131C 'send':10A 'separ':101B 'ship':121B 'site':20A 'sync':114B 'token':14A,72B 'tool':36B 'ui':4A,42B,47B,157C 'url':52B 'use':184C 'vendor':186C 'version':89B 'vulner':132C 'way':199C 'web':3A,41B,46B,112B,156C 'web-ui':40B","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Kimi Code Web UI (versions up to 2.5.2) and click links to it from untrusted sources. A crafted link can send the UI's API requests, with the bearer token, to another origin, according to the maintainers' PR. CLI-only users who never start the Web UI can skip it. I could not confirm whether the current Web UI starts by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["kimicode"],"ptokens":["code","kimi"],"labels":["aicodingagent","aitooling","kimicode","medium","webui"],"campaign_type":null,"search_a":"'-126757':23A,26A '-2026':22A,25A 'api':11A 'attack':18A 'bearer':13A 'code':2A,29A 'craft':5A 'cve':21A,24A 'includ':15A 'kimi':1A,6A,28A 'kimi-code':27A 'link':8A 'origin':7A 'request':12A 'send':10A 'site':20A 'token':14A 'ui':4A 'web':3A","search_b":"'-10':126B '-11':125B '2.5.2':92B '2.5.3':123B '2026':124B '3964':63B '775':107B 'agent':33B 'ai':31B,35B 'ai-coding-ag':30B 'ai-tool':34B 'api':69B 'app':106B 'attack':77B 'attacker-control':76B 'bearer':71B 'bundl':113B 'code':32B,39B,44B,105B 'confirm':119B 'control':78B 'could':67B 'craft':65B 'describ':96B 'dist':111B 'dist-web':110B 'fix':94B 'frame':81B 'honor':48B 'http':55B 'includ':73B 'isoriginallow':88B 'kimi':38B,43B,50B,104B 'kimi-cod':37B 'kimi-code-app':103B 'land':98B 'later':115B 'link':66B 'mention':129B 'moonshot':59B 'note':118B 'nvd':80B 'open':85B 'origin':51B,79B 'page':57B 'paramet':53B 'per':58B 'pr':62B 'redirect':68B,86B 'releas':117B 'repo':102B 'request':70B 'separ':101B 'ship':121B 'sync':114B 'token':72B 'tool':36B 'ui':42B,47B 'url':52B 'version':89B 'web':41B,46B,112B 'web-ui':40B","search_c":"'2.5.2':143C 'affect':145C 'ai':138C 'apps/kimi-code/dist-web/assets/index-hu0lcm-x.js':152C 'argument':162C 'attack':170C 'code':140C 'compon':155C 'contact':188C 'detect':135C 'disclos':179C 'disclosur':192C 'earli':189C 'execut':173C 'exploit':176C 'file':151C 'function':147C 'isoriginallow':148C 'kimi':139C,163C 'lead':165C 'manipul':159C 'may':182C 'moonshot':137C 'open':167C 'origin':164C 'public':180C 'redirect':168C 'remot':174C 'respond':196C 'secur':131C 'ui':157C 'use':184C 'vendor':186C 'vulner':132C 'way':199C 'web':156C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126757","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126757","severity":null,"published_at":"2026-11-11T23:17:11+00:00","modified_at":"2026-11-11T23:17:11+00:00","first_seen_at":"2026-11-11T23:29:35+00:00","fetched_at":"2026-11-11T23:29:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126757:3670","url":"https://github.com/MoonshotAI/kimi-code/pull/3964","severity":null,"published_at":"2026-11-11T23:32:26+00:00","modified_at":"2026-11-11T23:32:26+00:00","first_seen_at":"2026-11-11T23:32:26+00:00","fetched_at":"2026-11-11T23:32:26+00:00","note":"Maintainer PR #3964 confirms the kimi_origin issue (token leak to attacker origin). Fix is tracked in kimi-code-app#775 (not read); no released fixed version stated; 2.5.3 changelog silent. Vendor docs I found are for the older kimi-cli. Fix left unknown; ecosystem npm is inferred from the @moonshot-ai/kimi-code package name.","cites":["https://github.com/MoonshotAI/kimi-code/pull/3964","https://moonshotai.github.io/kimi-code/en/release-notes/changelog.md","https://moonshotai.github.io/kimi-cli/en/reference/kimi-web.html"]}],"documents":[{"id":130122,"url":"https://github.com/MoonshotAI/kimi-code/pull/3964","title":"MoonshotAI/kimi-code PR #3964: harden workspace trust boundaries (mentions kimi_origin)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":130123,"url":"https://moonshotai.github.io/kimi-code/en/release-notes/changelog.md","title":"Kimi Code changelog","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":130124,"url":"https://moonshotai.github.io/kimi-cli/en/reference/kimi-web.html","title":"Kimi Code Web UI docs","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}