The vulnerability in HCL AION allows insufficient protection against repeated authentication attempts, enabling brute‑force attacks. Because authentication checks do not enforce account lockout or rate limiting, an attacker could repeatedly try credentials, potentially gaining access to user accounts or compromising systems if weak passwords are used. This leads to a compromise of confidentiality, integrity, and availability of the targeted accounts.

The issue affects the HCL AION product from HCL. No specific version information is provided, so all deployed instances should be considered potentially impacted until a vendor‑issued fix becomes available.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not currently listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote, involving repeated login attempts against the application’s authentication interface. The risk escalates if weak passwords or lack of multi‑factor authentication are present. Without mitigating controls such as rate limiting or lockout, the exploitation confidence is reasonably high under typical conditions.