Open Redirect Vulnerability in HCL AION's GenAI Web Interface

CVE-2026-35102

What is CVE-2026-35102?

HCL AION's GenAI web interface contains an open redirect vulnerability in its navigation bar. The issue arises from the switch-version action, which redirects users to a dynamically constructed URL—specifically 'window origin + /workspace'—without proper validation of the redirect destination. This flaw can be exploited by attackers to carry out phishing attacks or lead users to unintended external sites, potentially compromising user data and impacting overall application security.

References