Description

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-11-06T14:17:12.330Z",
  "pubdate": "2026-11-06T14:17:12.330Z",
  "executiveSummary": "HCL AION contains an open redirect vulnerability located within the UserMenu component of the GenAI web interface. This security flaw stems from the application's reliance on the untrusted configuration parameter NEXT_PUBLIC_LOGIN_URL to dictate redirection logic during the logout process without performing necessary input validation or origin sanitization.\nThis vulnerability allows an attacker to manipulate the redirection destination, facilitating phishing campaigns by leading authenticated users to arbitrary malicious sites. By crafting a URL that leverages the insecure redirection mechanism, an adversary can deceive users into providing credentials or sensitive data on a fraudulent page that appears legitimate. The risk is significant as it exploits the implicit trust users place in the HCL AION application domain. Successful exploitation does not require advanced access but relies on social engineering, as the attacker must entice the victim to interact with the malicious redirection link. The vulnerability presents a clear risk to organizational identity security and user trust, necessitating immediate configuration adjustments to enforce strict allow-listing of redirect destinations.",
  "technicalDetails": "The vulnerability resides in the UserMenu component of the HCL AION GenAI web interface. The root cause is an improper neutralization of user-controlled input used within a server-side or client-side redirect function. Specifically, upon triggering the logout process, the application references the NEXT_PUBLIC_LOGIN_URL configuration variable to determine the post-logout landing page.\nBecause the application fails to validate the protocol, host, or path of this variable against a predefined whitelist of trusted domains, it permits the transition to external, attacker-controlled URIs. In a typical attack flow, an adversary identifies the endpoint responsible for the logout action and observes that it incorporates a redirect parameter derived from the configuration. The attacker can then exploit this by influencing the environment configuration or, if the variable is reflected in the URL parameters of the logout request, injecting a malicious URL encoded as a query string component.\nWhen a victimized user initiates the logout sequence, the application reads the value of NEXT_PUBLIC_LOGIN_URL. If the value has been manipulated or if the application lacks strict logic to ensure the destination remains within the expected origin, the browser is instructed to navigate to an external domain. This behavior is particularly dangerous because the browser's address bar may still be in the process of transitioning, and users often associate the initial secure session termination with the final destination. The lack of validation means that any protocol (e.g., http://, https://, or even javascript: pseudo-protocols depending on the browser and implementation) can be utilized.\nThe component affected is specifically the UserMenu, which likely handles the session termination logic. Exploitation does not require elevated privileges; however, it generally requires the user to be currently authenticated, as the redirect is tied to the logout flow. The network exposure is broad, as the web interface is accessible to any user with legitimate access to the HCL AION GenAI platform. Post-exploitation impact involves the redirection of the user to a credential harvesting site or a phishing landing page, effectively bypassing the security boundary of the intended application. Because the redirect originates from a trusted enterprise domain, automated security filters and user intuition are frequently bypassed, increasing the probability of successful credential compromise."
}