The vulnerability is an open redirect flaw in the navigation bar component of HCL AION’s GenAI web interface. When a user triggers the switch‑version action, the browser is redirected to a URL constructed from the current window origin plus "/workspace" without any validation of the target. This flaw is classified as CWE‑601 and enables an attacker to craft a link that appears legitimate but forwards the victim to a different site, potentially facilitating phishing or misleading users to an unintended internal page. The attack vector, which requires the user to click a crafted link that looks legitimate, is inferred from the redirect behavior described.

The defect exists in the GenAI web interface bundled with HCL Software’s HCL AION product. All installations that include the GenAI navigation bar are vulnerable, regardless of deployment type; no specific version range is supplied, so any current release is assumed affected until the vendor releases a fix. Based on the lack of a specified version range, it is inferred that any current release is affected until a vendor patch is available.

The CVSS score of 4.7 indicates moderate severity, as the vulnerability requires user interaction to trigger an unwanted redirect. Based on the description, it is inferred that the attacker must obtain the victim’s interaction with a crafted link, likely delivered via phishing or a compromised site. The EPSS score is not available and the flaw is not listed in CISA KEV, suggesting limited public exploitation. Nonetheless, because a crafted link can be embedded in an email or a compromised site, the risk for targeted phishing campaigns is realistic. Exploitation relies on the victim clicking the malicious link and does not require elevated privileges.