JWT Token Expiry Issue in HCL AION Version 2
CVE-2025-52661

2.4LOW

Key Information:

Vendor

HCL Software Software

Status
Aion
Vendor
CVE Published:
19 January 2026

What is CVE-2025-52661?

HCL AION version 2 is susceptible to a JWT Token Expiry Too Long vulnerability. This flaw allows for excessively long token expiration times, increasing the likelihood of token misuse. If compromised, the lengthy validity of the tokens can lead to unauthorized access to sensitive resources, thereby posing a significant risk to system integrity and user data. Organizations using HCL AION are advised to review their token management policies and implement stricter expiration controls.

Affected Version(s)

AION 2

References

https://support.hcl-software.com/kb_view.do?sys_kb_id=4b9...

CVSS V3.1

Score:
2.4
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.