HCL AION contains an open redirect in the RoleAssignPending component, where the application uses a URL from build configuration to redirect to the login page without validating the destination. This flaw can be leveraged to send users to malicious sites as part of a phishing campaign, potentially leading to credential theft or phishing scams when users think they are navigating to legitimate pages. The vulnerability is classified as CWE-601 and carries a CVSS score of 4.7, indicating a moderate potential impact when properly exploited.

The affected product is HCL Software’s HCL AION. No specific product versions are listed in the CVE entry; therefore, any deployment of HCL AION that includes the RoleAssignPending component is potentially vulnerable until a vendor patch is applied.

The CVSS score reflects modest severity, and the EPSS score is unavailable, suggesting limited publicly known exploitation. HCL AION is not listed in the CISA KEV catalog, so no large-scale exploit activity has been reported to date. The likely attack path is via the role assignment pending page, where an attacker crafts a URL that redirects users to an external site. Successful exploitation requires user interaction (clicking the link) and can be mitigated by restricting redirect destinations or applying a vendor patch.