Sensitive Session Information Vulnerability in HCL AION
CVE-2025-52633

3.1LOW

Key Information:

Vendor

HCL Software
Status
Aion
Vendor
CVE Published:
3 February 2026

What is CVE-2025-52633?

HCL AION is vulnerable to an issue where sensitive session information is stored in persistent cookies. This practice heightens the risk of unauthorized access, especially if the cookies are intercepted or compromised by malicious actors. It is critical for users to evaluate the security settings of their AION deployments to mitigate the potential for exploitation through this vulnerability.

Affected Version(s)

AION 2.0

References

https://support.hcl-software.com/csm?id=kb_article&syspar...

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.