CVE-2026-5345

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-35106

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface UserContext component, line 89. A second redirect to the login page in this component used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect...

CVE-2026-35105

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface UserContext component, line 78. The redirect to the login page used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used...

CVE-2026-35107

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface UserMenu component. The redirect to the login page on logout used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used in phishing...

CVE-2026-35102

HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface Navbar component. The switch-version action redirected the browser to a dynamically constructed URL window origin + '/workspace' without validating the redirect destination. This may be used in...

CVE-2026-21849

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-5345 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

EUVD-2026-118262

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://test instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-5345

The HCL AION platform is affected by a missing encryption vulnerability (CWE-311) within the GenAI web interface . The vulnerability stems from a second WebSocket connection using the unencrypted ws://test protocol instead of the secure wss:// channel. This flaw could allow an attacker on the net...

CVE-2026-21849

HCL AION is affected by a missing encryption vulnerability within the GenAI web interface . The application uses an unencrypted WebSocket protocol (ws://localhost:8000 ) instead of a secure wss:// channel. This configuration could allow an attacker on the network to intercept or read data exchang...

EUVD-2026-118261

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

CVE-2026-21849 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web interface. The connection used the unencrypted WebSocket protocol ws://localhost:8000 instead of an encrypted wss:// channel. This may allow data exchanged over the connection to be...

EUVD-2026-118260

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface UserMenu component. The redirect to the login page on logout used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used in phishing...

CVE-2026-35107 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface UserMenu component. The redirect to the login page on logout used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used in phishing...

CVE-2026-35107

The HCL AION platform is impacted by an open redirect vulnerability within the UserMenu component of the GenAI web interface. The root cause is that the application performs a redirect to a login page upon logout using a URL from the build configuration (NEXT_PUBLIC_LOGIN_URL ) without validating...

CVE-2026-35106 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface UserContext component, line 89. A second redirect to the login page in this component used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect...

CVE-2026-35106

HCL AION is affected by an open redirect vulnerability within the session-handling logic of the GenAI web interface . The flaw exists in the UserContext component (line 89), where a secondary redirect to the login page uses a URL from the NEXT_PUBLIC_LOGIN_URL build configuration without validati...

EUVD-2026-118259

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface UserContext component, line 89. A second redirect to the login page in this component used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect...

CVE-2026-35105

The HCL AION GenAI web interface is vulnerable to an open redirect due to a flaw in the session-handling logic within the UserContext component (line 78). The application redirects users to a login page using a URL from the NEXT_PUBLIC_LOGIN_URL build configuration without validating the destinat...

CVE-2026-35105 HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface UserContext component, line 78. The redirect to the login page used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used...