Open Redirect Vulnerability in HCL AION GenAI Web Interface

CVE-2026-35105

What is CVE-2026-35105?

HCL AION features an open redirect vulnerability in the session-handling logic of its GenAI web interface, specifically within the UserContext component. This flaw allows an attacker to redirect users to arbitrary URLs that originate from an insecure build configuration (NEXT_PUBLIC_LOGIN_URL) without appropriate validation. As a result, this vulnerability can facilitate phishing attacks by misleading users into visiting malicious sites, potentially leading to unintended behaviors and adverse security impacts. It is crucial for HCL AION users to be aware of this issue and implement protective measures.

References