{"id":"CVE-2026-35107","kind":"vulnerability","aliases":["CVE-2026-35107"],"related":[],"title":"HCL AION: open redirect in GenAI web interface user menu logout","description":"HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component). The redirect to the login page on logout used a URL taken from build configuration (NEXT_PUBLIC_LOGIN_URL) without validating the redirect destination. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"The logout redirect in the GenAI web interface user menu takes its login URL from build configuration without checking the destination. An attacker can use it to send users to a malicious site that looks like the real login page, enabling phishing.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["genai-web-ui","hcl-aion","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check whether the AION GenAI web interface is deployed and which build sets `NEXT_PUBLIC_LOGIN_URL`","fix":null,"status":"open","published_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","triaged_at":"2026-11-06T14:43:40+00:00","updated_at":"2026-11-06T14:43:40+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-06T14:43:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"HCL AION: open redirect in GenAI web interface user menu logout","impact":"low","summary":"The logout redirect in the GenAI web interface user menu takes its login URL from build configuration without checking the destination. An attacker can use it to send users to a malicious site that looks like the real login page, enabling phishing.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["hcl-aion","genai-web-ui","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"users are redirected to a phishing page after logout","analyst_note":"Find affected and fixed AION versions and the vendor advisory for CVE-2026-35107 at the HCL security bulletins page; the NVD entry alone does not give ranges.","how_to_check":"- Check whether the AION GenAI web interface is deployed and which build sets `NEXT_PUBLIC_LOGIN_URL`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"The flaw is in the UserMenu component of the HCL AION GenAI web interface, where logout redirects to a URL from build configuration without validation. Teams running AION's GenAI web interface are exposed; the sources do not say which versions are affected or whether a default configuration is vulnerable.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000693,"input_tokens":4260,"output_tokens":534,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-35107':14A,17A 'affect':74C 'aion':2A,24B,72C 'attack':51B,121C 'behavior':126C 'build':44B,104C 'certain':131C 'check':47B 'compon':90C 'condit':132C 'configur':45B,105C 'cve':12A,15A 'destin':49B,114C 'enabl':69B 'genai':6A,19B,34B,86C 'genai-web-ui':18B 'hcl':1A,23B,71C 'hcl-aion':22B 'host':27B 'impact':129C 'interfac':8A,36B,88C 'like':64B 'login':41B,67B,95C,108C 'logout':11A,30B,98C 'look':63B 'malici':60B 'may':116C 'menu':10A,38B,83C 'next':106C 'open':3A,77C 'page':68B,96C 'phish':70B,120C 'potenti':122C 'public':107C 'real':66B 'redirect':4A,31B,78C,92C,113C 'result':123C 'secur':128C 'self':26B 'self-host':25B 'send':56B 'site':61B 'take':39B 'taken':102C 'ui':21B 'unintend':125C 'url':42B,101C,109C 'use':53B,99C,118C 'user':9A,37B,57B,82C 'usermenu':89C 'valid':111C 'vendor':28B 'vulner':79C 'web':7A,20B,35B,87C 'without':46B,110C","nicknames":[],"mitigations":[],"who_affected":"The flaw is in the UserMenu component of the HCL AION GenAI web interface, where logout redirects to a URL from build configuration without validation. Teams running AION's GenAI web interface are exposed; the sources do not say which versions are affected or whether a default configuration is vulnerable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["genaiwebui","hclaion","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-2026':13A,16A '-35107':14A,17A 'aion':2A 'cve':12A,15A 'genai':6A 'hcl':1A 'interfac':8A 'logout':11A 'menu':10A 'open':3A 'redirect':4A 'user':9A 'web':7A","search_b":"'aion':24B 'attack':51B 'build':44B 'check':47B 'configur':45B 'destin':49B 'enabl':69B 'genai':19B,34B 'genai-web-ui':18B 'hcl':23B 'hcl-aion':22B 'host':27B 'interfac':36B 'like':64B 'login':41B,67B 'logout':30B 'look':63B 'malici':60B 'menu':38B 'page':68B 'phish':70B 'real':66B 'redirect':31B 'self':26B 'self-host':25B 'send':56B 'site':61B 'take':39B 'ui':21B 'url':42B 'use':53B 'user':37B,57B 'vendor':28B 'web':20B,35B 'without':46B","search_c":"'affect':74C 'aion':72C 'attack':121C 'behavior':126C 'build':104C 'certain':131C 'compon':90C 'condit':132C 'configur':105C 'destin':114C 'genai':86C 'hcl':71C 'impact':129C 'interfac':88C 'login':95C,108C 'logout':98C 'may':116C 'menu':83C 'next':106C 'open':77C 'page':96C 'phish':120C 'potenti':122C 'public':107C 'redirect':78C,92C,113C 'result':123C 'secur':128C 'taken':102C 'unintend':125C 'url':101C,109C 'use':99C,118C 'user':82C 'usermenu':89C 'valid':111C 'vulner':79C 'web':87C 'without':110C","first_public_at":"2026-11-06T14:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-35107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35107","severity":null,"published_at":"2026-11-06T14:17:12+00:00","modified_at":"2026-11-06T14:17:12+00:00","first_seen_at":"2026-11-06T14:42:11+00:00","fetched_at":"2026-11-06T14:42:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}