CVE-2026-35103

HCL AION can redirect users from its role-pending page

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Unvalidated redirect from the role-pending page. The flow can direct the user to an untrusted login site.

Severity and exploitation evidence

Medium · 4.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The pending-role page accepts the configured login destination without validating it.

Conditions required

A user must encounter the pending-role flow with a login destination an attacker can influence. HCL does not specify how configuration control is obtained.

Potential impact

The flow can direct the user to an untrusted login site.

Affected versions and configurations

2.6.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Validate configuration-sourced identity destinations before navigation.

Evidence and limits

HCL bulletin KB0135118 was published 2026-11-04 and identifies 2.8.0 as the fix. HCL’s CVE record gives 2026-11-03 as its public date.

Sources