CVE-2026-35106

MediumCVSS 4.7/10Last modified Nov 6, 2026

Description

HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 89). A second redirect to the login page in this component used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
HCL Software	HCL AION	V 2.6.0

References

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-351074.7HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the CVE-2026-351093.7HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate proxies. Sensitive info CVE-2026-35118.6Improper Restriction of XML External Entity Reference vulnerability in XMLUtils.java in Slovensko.Digital Autogram allows remote unauthentic CVE-2026-351105.4HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests. Data may be transmitted ove CVE-2026-351114.8HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application r CVE-2026-351124.2HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-orig CVE-2026-351134.8HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin do CVE-2026-351143.7HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff res CVE-2026-351153.7HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so brow CVE-2026-35126.1The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up CVE-2026-35136.4The TableOn – WordPress Posts Table Filterable plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tableon_button' sh CVE-2026-35147.5In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions fo