CVE-2026-35102 in AION
Summary
by MITRE • 11/06/2026
HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar component). The switch-version action redirected the browser to a dynamically constructed URL (window origin + '/workspace') without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified within HCL AION represents an open redirect flaw located specifically in the navigation bar component of its GenAI web interface. This issue stems from a lack of input validation on the switch-version action, which constructs a redirection URL by concatenating the window origin with a static path segment for the workspace without verifying if the resulting destination is legitimate or safe. In modern web application architecture, such dynamic URL construction that relies solely on client-side context like the window origin can be exploited if an attacker can influence any part of the redirect logic or if the implementation fails to strictly enforce allowlists for target domains. The core technical flaw lies in the absence of rigorous validation mechanisms before executing a browser navigation command based on user-supplied or dynamically generated parameters, which violates fundamental principles of secure coding regarding trust boundaries and input sanitization.
From an operational perspective, this vulnerability poses a significant risk primarily related to social engineering and phishing campaigns. Attackers can craft malicious links that appear to originate from the legitimate HCL AION domain due to the use of the window origin in the redirect path. When users click these links, they are redirected to a page that mimics the trusted environment, potentially leading them to disclose sensitive credentials or personal information on a phishing site hosted by the attacker. While the immediate technical impact may be limited to redirection rather than direct code execution or data exfiltration from the server, the secondary effects can include account compromise through credential harvesting, session hijacking if cookies are stolen during the transition, and reputational damage for the organization deploying HCL AION as users lose trust in the platform's security posture.
This vulnerability aligns with CWE-601, which defines URL Redirection to Untrusted Site (Open Redirect), a common weakness where an application redirects users to URLs provided by untrusted sources without proper validation. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this flaw facilitates Initial Access techniques such as Phishing: Valid Accounts or Spearphishing Link, allowing adversaries to bypass basic domain verification checks that many email filters and security awareness training programs rely upon. The exploitation vector typically involves sending a crafted URL via phishing emails or malicious websites, leveraging the user's trust in the visible domain name to lower their guard before they are redirected away from the legitimate application interface.
To mitigate this vulnerability, developers should implement strict allowlist validation for all redirect destinations rather than relying on dynamic origin concatenation alone. The navigation bar component must validate that any target URL belongs to a predefined list of trusted domains or paths before executing the redirection logic. Additionally, implementing Content Security Policy headers can help restrict where scripts and navigations are allowed to occur, adding an extra layer of defense against malicious redirects. Regular security code reviews focusing on input validation for all user-controlled parameters involved in navigation flows are essential to prevent similar issues across other components of the GenAI web interface.