The vulnerability is an open redirect caused by the GenAI web interface’s session-handling logic using the NEXT_PUBLIC_LOGIN_URL configuration without validating the redirect destination. An attacker can craft a malicious URL that redirects a user to an arbitrary site after attempting to log in, creating an opportunity for phishing, loss of trust, or potential credential theft if the user follows the redirect.

The affected product is HCL AION’s GenAI web interface, specifically the UserContext component. No specific product versions are listed in the advisory, so the vulnerability exists in all releases that employ the current session-handling logic that references NEXT_PUBLIC_LOGIN_URL.

The CVSS score of 4.7 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote over the web; any user who visits a crafted redirect URL can trigger the vulnerability. Because no authentication is required, the risk lies primarily in phishing, where attackers can lure users to malicious sites.