CVE-2026-35106

HCL AION has a second unvalidated session login redirect

HCL Software · HCL AION

First documented disclosure · Review checkpoint

Summary

Second unvalidated session redirect to login. The second redirect can also send users to an untrusted website.

Severity and exploitation evidence

Medium · 4.7/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed public sources describe the vulnerability and its conditions. Malicious exploitation has not been established in the reviewed sources.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A separate branch of the same user-session component also accepts a configured login destination without validation.

Conditions required

A user must encounter this second branch with a destination an attacker can influence. The bulletin distinguishes it from CVE-2026-35105.

Potential impact

The second redirect can also send users to an untrusted website.

Affected versions and configurations

2.6.0.

Fix and mitigation status

2.8.0.

Practical next steps

Upgrade HCL AION to 2.8.0 and verify the affected control in the deployed interface.

Operating lesson

Test each session transition that can navigate to an identity provider.

Evidence and limits

HCL bulletin KB0135118 was published 2026-11-04 and identifies 2.8.0 as the fix. HCL’s CVE record gives 2026-11-03 as its public date.

Sources