Loading vulnerability…
Open Redirect in HCL AION GenAI Session Handling
HCL AION versions 2.6.0 and 2.7.0 contain an open redirect vulnerability in the GenAI web interface's session-handling logic. The UserContext component redirects users to a login destination obtained from the NEXT_PUBLIC_LOGIN_URL build configuration without validating that destination. A malicious configured destination could redirect users to an attacker-controlled site and facilitate phishing. How an attacker could influence the configured URL is not established.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Users following the login redirect could be directed to an untrusted site, enabling phishing or credential collection through an impersonated login page. Additional security consequences are not established for this vulnerability.
If you can’t patch tonight, do this now.
As an interim precaution, restrict modification of the build configuration and verify that NEXT_PUBLIC_LOGIN_URL points only to an approved, trusted login destination. No vendor-provided temporary workaround is identified.
Patch, then assume compromise.
Upgrade HCL AION to version 2.8.0, which remediates the vulnerability. The underlying code-level correction is to validate the configured login redirect destination against an explicit allowlist of trusted destinations before redirecting.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.