Open Redirect Vulnerability in HCL AION's GenAI Web Interface

CVE-2026-35107

What is CVE-2026-35107?

HCL AION is impacted by an open redirect vulnerability within the UserMenu component of the GenAI web interface. This vulnerability arises when the application redirects users to the login page upon logout, utilizing a URL derived from the build configuration (NEXT_PUBLIC_LOGIN_URL) without sufficient validation of the redirect destination. Exploit of this flaw can facilitate phishing schemes, allowing attackers to redirect users to malicious sites. This raises significant security concerns, potentially enabling unintended behavior under specific conditions.

References