{"id":"CVE-2026-35104","kind":"vulnerability","aliases":["CVE-2026-35104"],"related":[],"title":"HCL AION: signup page open redirect sends users to untrusted sites","description":"HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"The AION user registration page takes a 'redirect' query parameter and sends the user there after signup without checking it. A crafted registration link can therefore send a user to an attacker-chosen external site, which is useful for phishing.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other","self-hosted"],"not_affected_if":["signup-disabled"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T14:17:11+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:44+00:00","updated_at":"2026-11-06T14:43:44+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T14:43:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HCL AION: signup page open redirect sends users to untrusted sites","impact":"low","summary":"The AION user registration page takes a 'redirect' query parameter and sends the user there after signup without checking it. A crafted registration link can therefore send a user to an attacker-chosen external site, which is useful for phishing.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"users are redirected to a phishing site after registering","analyst_note":"Find the affected and fixed AION versions and whether the registration page is reachable without an account, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-35104 and HCL's advisory.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["signup-disabled"],"who_is_affected":"Teams that run HCL AION with self-service user registration enabled are exposed, since the flaw sits on the Signup component. The sources do not say which AION versions are affected or whether registration must be open to the public. Deployments where sign-up is closed or limited to administrators are likely less exposed, but the sources do not confirm this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":4235,"output_tokens":492,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-35104':14A,17A 'affect':69C 'aion':2A,20B,26B,67C 'attack':57B,117C 'attacker-chosen':56B 'behavior':122C 'certain':127C 'check':43B 'chosen':58B 'compon':81C 'condit':128C 'could':102C 'craft':46B,99C 'cve':12A,15A 'extern':59B,109C 'hcl':1A,19B,66C 'hcl-aion':18B 'host':24B 'impact':125C 'link':48B,101C 'may':112C 'open':5A,72C 'page':4A,29B,79C 'paramet':34B,94C 'perform':84C 'phish':65B,116C 'potenti':118C 'queri':33B,93C 'redirect':6A,32B,73C,83C,92C 'registr':28B,47B,78C,86C,100C 'result':119C 'secur':124C 'self':23B 'self-host':22B 'send':7A,36B,51B,103C 'signup':3A,41B,80C 'site':11A,60B,110C 'take':30B 'therefor':50B 'unintend':121C 'untrust':10A,108C 'use':63B,87C,114C 'user':8A,27B,38B,53B,77C,105C 'valid':96C 'valu':89C 'vulner':74C 'without':42B,95C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HCL AION with self-service user registration enabled are exposed, since the flaw sits on the Signup component. The sources do not say which AION versions are affected or whether registration must be open to the public. Deployments where sign-up is closed or limited to administrators are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-35104':14A,17A 'aion':2A 'cve':12A,15A 'hcl':1A 'open':5A 'page':4A 'redirect':6A 'send':7A 'signup':3A 'site':11A 'untrust':10A 'user':8A","search_b":"'aion':20B,26B 'attack':57B 'attacker-chosen':56B 'check':43B 'chosen':58B 'craft':46B 'extern':59B 'hcl':19B 'hcl-aion':18B 'host':24B 'link':48B 'page':29B 'paramet':34B 'phish':65B 'queri':33B 'redirect':32B 'registr':28B,47B 'self':23B 'self-host':22B 'send':36B,51B 'signup':41B 'site':60B 'take':30B 'therefor':50B 'use':63B 'user':27B,38B,53B 'without':42B","search_c":"'affect':69C 'aion':67C 'attack':117C 'behavior':122C 'certain':127C 'compon':81C 'condit':128C 'could':102C 'craft':99C 'extern':109C 'hcl':66C 'impact':125C 'link':101C 'may':112C 'open':72C 'page':79C 'paramet':94C 'perform':84C 'phish':116C 'potenti':118C 'queri':93C 'redirect':73C,83C,92C 'registr':78C,86C,100C 'result':119C 'secur':124C 'send':103C 'signup':80C 'site':110C 'unintend':121C 'untrust':108C 'use':87C,114C 'user':77C,105C 'valid':96C 'valu':89C 'vulner':74C 'without':95C","first_public_at":"2026-11-06T14:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35104","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35104","severity":null,"published_at":"2026-11-06T14:17:11+00:00","modified_at":"2026-11-06T14:17:11+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}