← Vulnerability feed

Vulnerability record · CVE-2026-126757 · published 11 November 2026

CVE-2026-126757: Open redirect vulnerability

A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

2.1 CVSS 4.0 Low CWE-601 · Open redirect Deferred
2.1CVSS 4.0 base score, v2 5.0
-EPSS exploitation probability, 30 days
NoNot in CISA KEV
0Affected product versions listed by NVD
5References
11 Nov 2026Last modified by NVD

Description

A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

LinkTags
https://mcniyfj5bw9b.feishu.cn/docx/IZ43dY0wzoDtnUxGgy7cQ6xcnFh
https://vuldb.com/cve/CVE-2026-126757
https://vuldb.com/submit/1033259
https://vuldb.com/vuln/435867
https://vuldb.com/vuln/435867/cti

Track CVE-2026-126757 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

4.7CVE-2012-0518Oracle Fusion Middleware SSO open redirect flawOracle Fusion Middleware 10.1.4.3.0 contains an unspecified open redirect vulnerability in the Application Server Single Sign-On component, tracked a…KEVEPSS 4.7%analysed6.1CVE-2021-38000Google Chrome Android Intents input validation open redirectChrome on Android before 95.0.4638.69 fails to properly validate untrusted input passed through Intents, allowing a crafted HTML page to redirect the…KEVEPSS 4.9%analysed

Source: NIST National Vulnerability Database (record CVE-2026-126757), CISA KEV, FIRST EPSS. This page is refreshed as NVD updates the record.