CVE-2026-35106: HCL AION is affected by multiple security vulnerabilities.

Published Nov 6, 2026

Updated

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXTPUBLICLOGINURL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Event History

Nov 6, 2026

CVE Published

via MITRE·01:37 PM

Data Sourced

via MITRE·01:37 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker would need to cause a user to follow a redirect flow involving the GenAI web interface. The issue arises because the UserContext session-handling logic redirects to a login URL without validating the destination.

What is the likely security impact?

The disclosed impact is phishing: an unvalidated redirect can send users to an attacker-controlled or otherwise unintended destination. The advisory also notes that unintended behavior or other security impact may occur under certain conditions.

What configuration should be reviewed while remediation is pending?

Review the NEXT_PUBLIC_LOGIN_URL build configuration used by the GenAI web interface. Ensure it points only to the intended login destination and is not set from untrusted or improperly controlled configuration sources.

CVE-2026-35106: HCL AION is affected by multiple security vulnerabilities.

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely security impact?

What configuration should be reviewed while remediation is pending?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely security impact?

What configuration should be reviewed while remediation is pending?