Open Redirect Vulnerability in HCL AION Product

CVE-2026-35103

What is CVE-2026-35103?

HCL AION is susceptible to an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). This weakness allows attackers to redirect users to arbitrary URLs by utilizing a URL from the build configuration (NEXT_PUBLIC_LOGIN_URL) without validation. Such exploitation could lead to phishing attacks, where users may unwittingly provide personal information or credentials to malicious sites, posing a significant security risk in specific contexts.

References