CVE-2025-52623

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-526246.1A vulnerability Bypass of the script allowlist configuration in HCL AION. An incorrectly configured Content-Security-Policy header may al CVE-2025-526257.5A vulnerability Cacheable SSL Page Found vulnerability has been identified in HCL AION. Cached data may expose credentials, system ide CVE-2025-526269.8A Potential Command Injection vulnerability in HCL AION. An This can allow unintended command execution, potentially leading to unauthori CVE-2025-526277.5Root File System Not Mounted as Read-Only configuration vulnerability. This can allow unintended modifications to critical system files, pot CVE-2025-526288.8HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-sit CVE-2025-526296.1HCL AION is susceptible to Missing Content-Security-Policy. An The absence of a CSP header may increase the risk of cross-site scripting a CVE-2025-52634.3Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vuln CVE-2025-526307.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526318.1HCL AION is affected by a Missing or Insecure HTTP Strict-Transport-Security (HSTS) Header vulnerability. This can allow insecure connection CVE-2025-526327.5A Missing Secure Attribute in Encrypted Session (SSL) Cookie vulnerability in HCL AION.This issue affects AION: 2.0.CVE-2025-526335.3HCL AION is affected by a Permanent Cookie Containing Sensitive Session Information vulnerability. It is storing sensitive session data in p CVE-2025-526347.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in HCL AION This issue affects HCL AION: 2.0.