CVE-2026-35107

HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface UserMenu component. The redirect to the login page on logout used a URL taken from build configuration NEXTPUBLICLOGINURL without validating the redirect destination. This may be used in phishing...