---
id: "CVE-2026-126757"
page: "https://infrastack.ai/live/CVE-2026-126757"
kind: "vulnerability"
aliases: ["CVE-2026-126757"]
title: "Kimi Code Web UI: crafted kimi_origin link can send API requests, bearer token included, to an attacker's site"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "kimi-code", "fixed": [], "affected": "<= 2.5.2", "ecosystem": "npm"}]
ecosystems: []
tags: ["ai-coding-agent", "ai-tooling", "kimi-code", "web-ui"]
not_affected_if: ["cli-only-use"]
published_at: "2026-11-11T23:17:11+00:00"
first_seen_at: "2026-11-11T23:29:35+00:00"
updated_at: "2026-11-11T23:32:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126757", "first_seen_at": "2026-11-11T23:29:35+00:00"}, {"source": "analyst", "url": "https://github.com/MoonshotAI/kimi-code/pull/3964", "first_seen_at": "2026-11-11T23:32:26+00:00", "cites": ["https://github.com/MoonshotAI/kimi-code/pull/3964", "https://moonshotai.github.io/kimi-code/en/release-notes/changelog.md", "https://moonshotai.github.io/kimi-cli/en/reference/kimi-web.html"]}]
exploit_sources: []
---

# Kimi Code Web UI: crafted kimi_origin link can send API requests, bearer token included, to an attacker's site

Link for people: https://infrastack.ai/live/CVE-2026-126757 (this .md is for agents)

Kimi Code's Web UI honored a kimi_origin URL parameter on HTTP(S) pages. Per Moonshot's own PR #3964, a crafted link could redirect API requests, bearer token included, to an attacker-controlled origin. NVD frames it as an open redirect in isOriginAllowed, versions up to 2.5.2. The fix is described as landing in a separate repo (kimi-code-app#775) with the dist-web bundle synced later. No release note confirms it shipped, and 2.5.3 (2026-11-10) does not mention it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:kimi-code affected <= 2.5.2 fixed no fixed version listed

## How to check

- Run kimi --version; 2.5.2 and earlier are listed as affected by NVD. 2.5.3 is not confirmed fixed.
- Check whether you start the Web UI (kimi web) and open links to it from untrusted sources.
- Also check whether it is bound beyond loopback (--network or --host); the docs for the earlier kimi-cli say the default is 127.0.0.1.

## Timeline

- 2026-11-11T23:29:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126757
- 2026-11-11T23:32:26+00:00 analyst https://github.com/MoonshotAI/kimi-code/pull/3964 — Maintainer PR #3964 confirms the kimi_origin issue (token leak to attacker origin). Fix is tracked in kimi-code-app#775 (not read); no released fixed version stated; 2.5.3 changelog silent. Vendor docs I found are for the older kimi-cli. Fix left unknown; ecosystem npm is inferred from the @moonshot-ai/kimi-code package name.

## Documents

- [advisory] MoonshotAI/kimi-code PR #3964: harden workspace trust boundaries (mentions kimi_origin) https://github.com/MoonshotAI/kimi-code/pull/3964
- [mentions] Kimi Code changelog https://moonshotai.github.io/kimi-code/en/release-notes/changelog.md
- [mentions] Kimi Code Web UI docs https://moonshotai.github.io/kimi-cli/en/reference/kimi-web.html

## From the sources

A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_