CVE-2026-35107 · Vendor
NO FIX YET
The logout redirect in the GenAI web interface user menu takes its login URL from build configuration without checking the destination. An attacker can use it to send users to a malicious site that looks like the real login page, enabling phishing.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
The flaw is in the UserMenu component of the HCL AION GenAI web interface, where logout redirects to a URL from build configuration without validation. Teams running AION's GenAI web interface are exposed; the sources do not say which versions are affected or whether a default configuration is vulnerable.
Not affected if unknown
Who cares genai-web-ui, hcl-aion, self-hosted
NEXT_PUBLIC_LOGIN_URLNo fix yet, per the sources.
HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.