Description

HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T14:17:11.690Z",
  "pubdate": "2026-11-06T14:17:11.690Z",
  "executiveSummary": "HCL AION is susceptible to an open redirect vulnerability located within the RoleAssignPending component. The application improperly handles redirection logic by utilizing a build-time configuration parameter, NEXT_PUBLIC_LOGIN_URL, as a destination for user redirection without implementing input validation or allow-listing mechanisms.\nThis vulnerability allows an attacker to craft malicious links that leverage the trusted domain of the HCL AION application to redirect unsuspecting users to arbitrary, potentially malicious external domains. Successful exploitation facilitates sophisticated phishing campaigns, as the initial interaction appears to originate from a legitimate, authenticated environment.\nThe primary risk implications involve credential harvesting, the distribution of malware, or the execution of cross-site scripting (XSS) attacks if the destination site facilitates such vectors. The vulnerability does not require complex pre-conditions, but it relies on user interaction to execute the redirection successfully. Consequently, HCL AION deployments using the affected configuration are exposed to social engineering risks that could undermine organizational security posture and user trust.",
  "technicalDetails": "The vulnerability originates from a failure in the application's redirect logic within the RoleAssignPending component, specifically concerning how it processes the redirect destination during the transition to the login page. The application relies on the NEXT_PUBLIC_LOGIN_URL environment variable as the source of truth for post-processing redirection, failing to sanitize or validate this input against a predefined list of authorized domains.\nIn a standard attack flow, an adversary identifies an entry point to the RoleAssignPending component. By manipulating parameters or leveraging the lack of server-side verification, the attacker influences the application to process a redirect payload. Because the application blindly trusts the value defined in NEXT_PUBLIC_LOGIN_URL—which can be manipulated or reflect an untrusted state if the build configuration is improperly secured—the application redirects the user's browser to an arbitrary URL controlled by the attacker.\nThe exploitation path is as follows: 1) An attacker constructs a malicious URL that points to the legitimate HCL AION instance, appending a crafted redirect parameter or triggering the vulnerable RoleAssignPending state. 2) The application processes the request and initiates an HTTP redirect response (typically a 302 status code) to the URI provided by the vulnerable configuration. 3) The victim's browser, receiving the trusted origin's redirect command, transparently navigates to the attacker-controlled destination. Because the initial navigation is to a trusted HCL AION endpoint, common browser-based protections and user intuition may be bypassed.\nThis vulnerability does not strictly require authentication to trigger in many web architectures, as the redirect often occurs prior to or during the authentication handshake process. The impact is significant in a post-exploitation context: attackers can mirror the HCL AION login interface on an external site to capture credentials, deliver malicious payloads, or exploit vulnerabilities in the user's browser via the malicious destination site. The absence of a robust URL validation framework or a strict Content Security Policy (CSP) that restricts redirect destinations exacerbates the severity of this flaw."
}