Description

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T14:17:12.007Z",
  "pubdate": "2026-11-06T14:17:12.007Z",
  "executiveSummary": "HCL AION contains an open redirect vulnerability within its GenAI web interface, specifically residing in the session-handling logic of the UserContext component. This flaw arises from the insecure handling of a redirect destination parameter derived from build-time configuration (NEXT_PUBLIC_LOGIN_URL) without adequate input validation. An attacker can manipulate this redirect functionality to coerce users into navigating to arbitrary, malicious domains. The primary security impact involves phishing attacks, where the trust associated with the HCL AION domain is leveraged to deceive users into disclosing sensitive credentials or interacting with malicious content. The vulnerability does not require authentication to trigger if the redirect logic is reachable, as it functions as a client-side navigation or server-side response manipulation. The risk is significant due to the potential for social engineering, facilitating credential theft and unauthorized access to organizational resources. Organizations are advised to implement strict URL allow-listing for all redirect operations to mitigate this threat.",
  "technicalDetails": "The vulnerability is situated in the UserContext component of the HCL AION GenAI web interface, specifically at line 78 of the application logic. The root cause is the improper implementation of a redirect mechanism that utilizes the NEXT_PUBLIC_LOGIN_URL environment variable to determine the destination for session-related redirections. In this implementation, the application fails to perform any form of server-side or client-side validation to ensure that the redirect target conforms to a known-safe, trusted domain or internal path.\nThe attack flow begins when an attacker crafts a malicious link that triggers the vulnerable redirect logic. Because the application logic blindly trusts the configuration parameter or allows for the injection of user-supplied input into this redirect flow, the application generates an HTTP response or a client-side location update that directs the user's browser to an arbitrary URL controlled by the attacker. By substituting the intended login destination with an attacker-controlled site, the user is transitioned away from the authenticated environment to a phishing page that mimics the HCL AION login interface.\nThis vulnerability is particularly effective because the initial navigation originates from the legitimate application domain, increasing the likelihood that the target user will perceive the redirect as a standard session-management procedure. The lack of validation on the redirect target allows for arbitrary redirection, including potential cross-site scripting (XSS) vectors if URL parameters are improperly reflected or if the redirection scheme supports 'javascript:' URI protocols depending on the specific implementation of the browser's navigation handling.\nThe scope of impact is characterized by the potential for credential harvesting. Once redirected, the user may be prompted to provide credentials on a deceptive page, allowing the attacker to capture session cookies, cleartext passwords, or secondary authentication factors. Furthermore, this open redirect serves as a platform for secondary attacks, such as drive-by-download attempts or the distribution of malicious payloads that exploit the perceived legitimacy of the HCL AION service.\nExploitation does not require high-level privileges; the primary requirement is the ability for the attacker to entice a legitimate user to click the crafted URL. The vulnerability is network-exposed as it is embedded within the public-facing GenAI web interface, making it accessible to any external user or internal threat actor capable of interacting with the web application."
}