A vulnerability in HCL Aftermarket DPC allows an attacker to keep an active session after the account password has been changed. Because the system does not invalidate existing sessions when a password is updated, an attacker who has previously accessed the session can continue to use it, effectively taking over the account. This weakness is as CWE‑613 and enables persistent unauthorized control without requiring any additional credentials.

The affected product is HCL Aftermarket DPC, version 1.0.0 as identified by the Common Platform Enumeration entry. No other vendor or product versions are listed in the provided data.

The CVSS score of 5.5 indicates moderate severity. Exploitation requires that the attacker already holds a valid session before the password change; after that, continued access is possible until the session expires or is manually terminated. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not a widely known or actively exploited issue. However, the potential for undetected account takeover makes it a significant risk for systems that rely on password changes for security mitigation.