CVE-2026-126757

Kimi Code's web interface could redirect a browser to an untrusted destination

Moonshot AI · Kimi Code web UI

First documented disclosure · Review checkpoint

Summary

Origin validation did not reliably constrain the browser redirect. Navigation could leave the intended origin.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The CNA reports that a demonstration is public. It does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Origin validation did not reliably constrain the browser redirect.

Conditions required

A user interacted with the affected web UI.

Potential impact

Navigation could leave the intended origin.

Affected versions and configurations

The CNA lists 2.5.0 through 2.5.2.

Fix and mitigation status

No fixed version is identified in the CNA report.

Practical next steps

Restrict access to the web UI and avoid following untrusted links into it pending a verified fix.

Operating lesson

Check the authority granted to the affected component against the operation a user expects.

Evidence and limits

The CVE record was published on 2026-11-11.

Sources