HCL AION · CVE-2026-35105 · AI agents & MCP
FIX → 2.8.0 ✓ verified
In HCL AION 2.6.0, the GenAI web interface's session handling (UserContext component, line 78) redirects to a login page whose URL comes from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the destination. HCL says this may be used in phishing attacks. HCL rates it CVSS 4.7 and fixes it in 2.8.0.
first public Nov 6, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running a self-hosted HCL AION 2.6.0 whose GenAI web interface redirects users to the login page using the NEXT_PUBLIC_LOGIN_URL build setting. A crafted flow could send users to a lookalike site for phishing, and it needs user interaction. Teams not running AION, or already on 2.8.0, can skip it.
Not affected if unknown
Who cares genai-web-ui, hcl-aion, nextjs, open-redirect, self-hosted
2.6.0 as affected by this CVE2.7.0 with HCL support, since the bulletin does not list it for this CVEUpgrade to 2.8.0
HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface (UserContext component, line 78). The redirect to the login page used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to HCL AION v2.8.0 (HCL says the upgrade remediates this; HCL AION support assists with the upgrade).