Description

HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-11-06T16:18:57.773Z",
  "pubdate": "2026-11-06T16:18:57.773Z",
  "executiveSummary": "HCL AION is susceptible to a credential exposure vulnerability originating from the improper configuration of autocomplete attributes on sensitive authentication forms.\nThe vulnerability allows web browsers to cache sensitive login credentials—including usernames and passwords—within the local browser data store.\nThis creates a security risk for multi-user systems or environments where a local attacker could gain unauthorized access to a victim's stored credentials through the browser's autofill cache.\nThe vulnerability does not require remote network exploitation; it is localized to the interaction between the application’s markup and the browser's credential management features.\nRisk implications include potential account takeover and unauthorized access to HCL AION instances if physical or local persistent access to the workstation is achieved.\nNo specific exploit payload is required beyond the browser's native functionality, as the application fails to instruct the user agent to suppress persistent storage of sensitive form input fields.",
  "technicalDetails": "The root cause of this vulnerability is the absence of the 'autocomplete=\"off\"' attribute or the 'autocomplete=\"new-password\"' directive on critical HTML input elements within the HCL AION login interface.\nWhen a web application does not explicitly disable autocomplete for sensitive fields, modern web browsers default to caching these inputs to improve user convenience. Consequently, the browser's internal database (e.g., SQLite files used by Chromium-based browsers or the Firefox login manager) persists the plain-text input.\nAttack flow involves a victim user authenticating to HCL AION on a shared or compromised workstation. Upon submission of the login form, the browser prompts the user to save the credentials. If accepted, or if default browser settings allow automatic saving, the sensitive credentials are written to the local disk.\nAn attacker with local file system access, or an attacker who can gain interactive access to the victim's browser profile, can extract these stored credentials.\nIn scenarios where a local user shares the same OS user profile, or where an attacker utilizes an automated script to parse browser-specific password storage files, the credentials can be exfiltrated without alerting the original user.\nThis vulnerability persists because the HCL AION server-side response does not enforce HTML-level directives that instruct the browser to omit these fields from its autofill history.\nThe exposure is strictly local and client-side; it does not bypass server-side authentication mechanisms, but rather compromises the client’s ability to protect the credentials during the input phase.\nPost-exploitation impact includes the full compromise of the user's HCL AION account, which may lead to unauthorized modification of system configurations, data exfiltration, or further administrative exploitation depending on the victim's privileges within the HCL AION environment.\nThe flaw affects the rendering of login components within the HCL AION front-end architecture, effectively undermining the security of the authentication flow by facilitating credential persistence in insecure, locally accessible browser repositories."
}