HCL AION contains an open redirect vulnerability in the user registration (Signup) component. The application accepts a 'redirect' query parameter after a user registers and forwards the user to that URL without performing validation. An attacker can craft a registration link that sends the newly registered user to an untrusted external site, enabling phishing or other malicious activities. The impact lies primarily in potential user deception and compromised confidentiality or integrity if the user trusts the link.

The affected product is HCL Software’s HCL AION. Affected versions are not explicitly listed in the advisory, so any deployment of the application that includes the described signup flow may be vulnerable. Administrators should verify the version and configuration of their HCL AION installation against the vendor’s documentation.

The CVSS score of 4.7 indicates moderate severity, but the EPSS score is not available, so the likelihood of exploitation cannot be quantified from the data provided. The vulnerability is not listed in the CISA KEV catalog, suggesting no known or active exploits at this time. Based on the description, the attack vector is horizontal—an external attacker can craft a malicious registration URL and entice a legitimate user to follow it. The exploit requires no special privileges and is client‑side, making it easy to execute once the redirect link is delivered to a target user.