CVE-2026-35103 in AION
Summary
by MITRE • 11/06/2026
HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified within HCL AION represents an open redirect flaw located specifically on the role assignment pending page associated with the RoleAssignPending component. The root cause of this issue stems from a failure to validate user-supplied input before utilizing it for navigation purposes. Specifically, the application constructs a redirection URL by concatenating or referencing a value derived from the build configuration variable NEXT_PUBLIC_LOGIN_URL without performing adequate checks on the destination domain or path structure. In web applications that utilize client-side frameworks like Next.js, such variables are often exposed to the browser environment, making them accessible for manipulation if not handled with strict validation logic. The absence of a whitelist mechanism or regex-based verification allows an attacker to craft URLs that appear legitimate but ultimately redirect users to malicious external domains under the guise of the trusted application interface.
This type of vulnerability is classified under CWE-601, which defines Open Redirect as a flaw where an application redirects users to a URL provided by the user without proper validation. The operational impact of this weakness extends beyond simple misdirection; it serves as a critical enabler for phishing campaigns and credential harvesting attacks. By leveraging the trusted domain name of HCL AION in the initial part of the redirect chain, attackers can create URLs that look authentic to end-users who are accustomed to seeing their organization's or vendor's web address. When users encounter such links via email, instant messaging, or other social engineering vectors, they may be lulled into a false sense of security and proceed to enter sensitive credentials on a spoofed login page hosted by the attacker. This undermines the integrity of the authentication process and can lead to unauthorized access if user credentials are compromised through this deceptive mechanism.
From an offensive security perspective, this vulnerability aligns with techniques observed in the MITRE ATT&CK framework, particularly those related to Phishing (T1566) and potentially Obfuscated Files or Information depending on how the redirect is masked. The attacker utilizes social engineering as a primary vector, relying on the visual trust associated with the legitimate application's domain to bypass user skepticism. Once redirected, the malicious site can mimic the login interface of HCL AION exactly, capturing usernames and passwords which are then exfiltrated to the attacker’s infrastructure. This scenario highlights how client-side configuration errors can have significant downstream security consequences by facilitating initial access through deception rather than technical exploitation of backend logic.
Mitigation strategies must focus on implementing strict validation rules for all redirect parameters within the application codebase. Developers should avoid using user-controlled or externally configurable values directly in redirection logic without sanitization. A robust approach involves maintaining a whitelist of allowed domains and paths that are permitted for redirection, ensuring that any input falling outside this predefined set is rejected or redirected to a safe default location such as the home page. Additionally, implementing Content Security Policy (CSP) headers can help mitigate some aspects of cross-site scripting attacks that might accompany open redirects, although CSP alone does not prevent direct URL manipulation in navigation events. Regular security code reviews and automated static analysis tools configured to detect CWE-601 patterns are essential for identifying such flaws early in the development lifecycle before they reach production environments where they can be exploited by malicious actors targeting organizational users.