The vulnerability arises from an open redirect in the session‑handling logic of HCL AION’s GenAI web interface. A redirect to the login page reuses a URL from a build‑time configuration constant without validating the destination, allowing an attacker to redirect users to arbitrary sites. This flaw, catalogued as CWE‑601, is typically exploited in phishing attacks and could expose users to malicious sites or unintended application behavior.

HCL AION is affected. No specific version information is provided, so all releases of the GenAI web interface that contain the implicated UserContext component are potentially vulnerable.

The CVSS score of 4.7 indicates a moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited observed exploitation. Attackers could trigger the redirect by visiting a crafted URL within the AION web interface; the vulnerability requires user interaction, does not grant additional privileges, but can be leveraged to facilitate phishing schemes.