HTTP Host Header Injection Vulnerability in HCL AION

CVE-2026-66981

What is CVE-2026-66981?

HCL AION is susceptible to an HTTP Host header injection, where the application fails to properly validate the HTTP Host header provided in user requests. This oversight allows an attacker to craft malicious requests that influence application behavior, leading to the possibility of unauthorized access or erroneous redirects. Such manipulation could expose sensitive information or alter the integrity of the application responses, posing a significant threat to users and data security.

References