Open Redirect Vulnerability in HCL AION Web Interface

CVE-2026-35106

What is CVE-2026-35106?

The HCL AION platform is susceptible to an open redirect vulnerability within the session-handling logic of its GenAI web interface. This issue arises in the UserContext component, which processes redirects to the login page using a URL derived from build configuration parameters. The lack of validation on the redirect destination opens the door for attackers to exploit this flaw, potentially facilitating phishing attempts and resulting in unintended behaviors that could undermine the security of the application.

References