{"id":"CVE-2026-66982","kind":"vulnerability","aliases":["CVE-2026-66982"],"related":[],"title":"HCL AION: browser autocomplete stores saved login credentials on sensitive forms","description":"HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials, potentially resulting in unintended behavior or security impact under certain conditions.","summary":"HCL AION enabled browser autocomplete on sensitive login form fields, so the browser can save and suggest typed values. A person with access to the same browser or machine could retrieve saved credentials.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hcl-aion","other","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T16:18:57+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","triaged_at":"2026-11-06T16:44:51+00:00","updated_at":"2026-11-06T16:44:51+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T16:44:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"HCL AION: browser autocomplete stores saved login credentials on sensitive forms","impact":"low","summary":"HCL AION enabled browser autocomplete on sensitive login form fields, so the browser can save and suggest typed values. A person with access to the same browser or machine could retrieve saved credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["hcl-aion","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"saved login credentials are readable by someone using the same browser","analyst_note":"Find the affected AION versions and the fixed release in the HCL security bulletin for CVE-2026-66982; the NVD entry gives no ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams that run HCL AION and whose users sign in through a browser on shared or unlocked machines. The sources do not state which AION versions are affected or what configuration is involved, so the exact scope is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000636,"input_tokens":4229,"output_tokens":427,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-66982':14A,17A 'access':47B,89C 'affect':61C 'aion':2A,20B,26B,59C 'allow':75C 'autocomplet':4A,29B,67C 'behavior':104C 'browser':3A,28B,37B,51B,66C,77C,93C 'certain':109C 'condit':110C 'could':54B,96C 'credenti':8A,57B,99C 'cve':12A,15A 'enabl':27B,69C 'enter':83C 'field':34B,74C 'form':11A,33B,73C 'hcl':1A,19B,25B,58C 'hcl-aion':18B 'host':24B 'impact':107C 'login':7A,32B,72C 'machin':53B 'malici':86C 'person':45B 'potenti':100C 'previous':82C 'result':101C 'retriev':55B,97C 'save':6A,39B,56B,98C 'secur':106C 'self':23B 'self-host':22B 'sensit':10A,31B,71C 'store':5A,79C 'suggest':41B,81C 'system':95C 'type':42B 'unintend':103C 'user':87C 'valu':43B,84C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Teams that run HCL AION and whose users sign in through a browser on shared or unlocked machines. The sources do not state which AION versions are affected or what configuration is involved, so the exact scope is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hclaion","low","other","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-66982':14A,17A 'aion':2A 'autocomplet':4A 'browser':3A 'credenti':8A 'cve':12A,15A 'form':11A 'hcl':1A 'login':7A 'save':6A 'sensit':10A 'store':5A","search_b":"'access':47B 'aion':20B,26B 'autocomplet':29B 'browser':28B,37B,51B 'could':54B 'credenti':57B 'enabl':27B 'field':34B 'form':33B 'hcl':19B,25B 'hcl-aion':18B 'host':24B 'login':32B 'machin':53B 'person':45B 'retriev':55B 'save':39B,56B 'self':23B 'self-host':22B 'sensit':31B 'suggest':41B 'type':42B 'valu':43B","search_c":"'access':89C 'affect':61C 'aion':59C 'allow':75C 'autocomplet':67C 'behavior':104C 'browser':66C,77C,93C 'certain':109C 'condit':110C 'could':96C 'credenti':99C 'enabl':69C 'enter':83C 'field':74C 'form':73C 'hcl':58C 'impact':107C 'login':72C 'malici':86C 'potenti':100C 'previous':82C 'result':101C 'retriev':97C 'save':98C 'secur':106C 'sensit':71C 'store':79C 'suggest':81C 'system':95C 'unintend':103C 'user':87C 'valu':84C 'vulner':64C","first_public_at":"2026-11-06T16:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@hcl.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66982","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66982","severity":null,"published_at":"2026-11-06T16:18:57+00:00","modified_at":"2026-11-06T16:18:57+00:00","first_seen_at":"2026-11-06T16:42:42+00:00","fetched_at":"2026-11-06T16:42:42+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}