4.7
Medium
CVE-2026-35105 HCL AION is affected by multiple security vulnerabilities.
Description
HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:NExploitable remotely over the network, without an account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- Interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| HCL AION | Versions not published |
Other CVEs of HCL AION
The 21 CVEs of HCL AION →
CVE-2026-66986
HCL AION is affected by multiple security vulnerabilities.
3.3
Low
CVE-2026-66987
HCL AION is affected by multiple security vulnerabilities.
5.3
Medium
CVE-2026-66982
HCL AION is affected by multiple security vulnerabilities.
3.3
Low
CVE-2026-66984
HCL AION is affected by multiple security vulnerabilities.
3.1
Low