Affected domain: sidekick-ui-next.kagi.com
Vulnerability: Dangling CNAME to deleted Cloudflare Pages project (kagi-sidekick-ui-next.pages.dev)
Researcher: Bug bounty research
An attacker can serve arbitrary content from a Kagi subdomain by claiming the deleted Cloudflare Pages project name.