CVE-2026-35102

MediumCVSS 4.7/10Last modified Nov 6, 2026

Description

HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirected the browser to a dynamically constructed URL (window origin + '/workspace') without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
HCL SoftwareHCL AIONV 2.6.0

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-351034.7HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to thCVE-2026-351044.7HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registCVE-2026-351054.7HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, lineCVE-2026-351064.7HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, lineCVE-2026-351074.7HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to theCVE-2026-351093.7HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive infoCVE-2026-35118.6Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthenticCVE-2026-351105.4HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted oveCVE-2026-351114.8HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application rCVE-2026-351124.2HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origCVE-2026-351134.8HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin doCVE-2026-351143.7HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff res
CVE-2026-35102: Medium severity, CVSS 4.7 | Vulnix