Description

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T14:17:12.170Z",
  "pubdate": "2026-11-06T14:17:12.170Z",
  "executiveSummary": "HCL AION contains an open redirect vulnerability within its GenAI web interface, specifically residing in the UserContext component. The flaw arises from insecure session-handling logic that utilizes unvalidated redirect destinations derived from build configurations.\nThe vulnerability allows an attacker to manipulate redirect URLs, facilitating phishing campaigns by directing unsuspecting users to malicious third-party domains. By exploiting this flaw, attackers can bypass security awareness filters, as the initial request originates from a trusted HCL AION domain, increasing the likelihood of user interaction.\nThe impact is primarily associated with social engineering and credential harvesting. While the vulnerability does not directly compromise the internal server-side integrity, it poses a significant risk to user data security by leveraging the perceived legitimacy of the HCL AION platform to facilitate external attacks. There are no specific privilege requirements for exploitation, as the redirect mechanism is often accessible to unauthenticated or partially authenticated sessions during the login flow.",
  "technicalDetails": "The vulnerability is located in the UserContext component at line 89 of the HCL AION GenAI web interface. The root cause is the improper handling of redirect destinations during the session-handling process, specifically when the application performs a secondary redirect to the login page.\nThe application relies on the 'NEXT_PUBLIC_LOGIN_URL' parameter sourced from the build configuration to determine the target for this redirect. The implementation fails to perform input validation or canonicalization on the destination URL prior to instructing the user's browser to navigate to it. This allows an attacker to inject arbitrary URLs into the redirect parameter.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious URL that points to a controlled external domain, potentially disguised as an legitimate login portal. Second, the attacker crafts a request to the HCL AION interface that triggers the vulnerable logic within the UserContext component, typically by manipulating session parameters or deep-link redirect variables. Third, the UserContext component processes the request at line 89, retrieves the unvalidated 'NEXT_PUBLIC_LOGIN_URL', and issues an HTTP 302 or similar redirect response to the attacker-supplied destination. Finally, the victim's browser follows the redirect, arriving at the malicious domain.\nBecause the redirect appears to initiate from a trusted HCL AION origin, the victim is more likely to trust the content hosted on the destination site, significantly increasing the efficacy of phishing attempts. This vulnerability effectively bypasses domain-based trust models. The flaw is inherent to the client-side/server-side transition of the web interface session-handling logic and does not require elevated privileges or complex network interception to exploit, provided the attacker can influence the input parameter that dictates the redirect behavior. Post-exploitation impact includes the potential for session hijacking, credential theft, and the distribution of malicious payloads under the guise of an authenticated session workflow."
}