CVE-2025-55264: HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change
Published Mar 26, 2026
·Updated
HCL Aftermarket DPC is affected by Failure to Invalidate Session on Password Change will allow attacker to access to a session, then they can maintain control over the account despite the password change leading to account takeover.
Affected Software
2 affected components
HCL Aftermarket DPC
hcltech Aftermarket Cloud=1.0.0
Event History
Mar 26, 2026
CVE Published
via MITRE·01:04 PM
Data Sourced
via MITRE·01:04 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-55264?
CVE-2025-55264 has a high severity level due to its potential for unauthorized account access.
2
How do I fix CVE-2025-55264?
To fix CVE-2025-55264, ensure that sessions are invalidated immediately after a password change.
3
What products are affected by CVE-2025-55264?
CVE-2025-55264 affects HCL Aftermarket DPC.
4
What could happen if CVE-2025-55264 is exploited?
If exploited, CVE-2025-55264 could allow attackers to retain access to user accounts after password changes.
5
Is there a workaround for CVE-2025-55264 until a patch is available?
A temporary workaround for CVE-2025-55264 is to manually invalidate sessions after password changes.