HCL AION exposes a configuration weakness where the Cross-Origin-Embedder-Policy (COEP) header is absent or incorrectly set, allowing embedded cross-origin resources to load without explicit permission. This undermines cross‑origin isolation, potentially leading to unintended behavior or security impact when cryptographic or sensitive content is accessed through rogue resources. The flaw is a classic information‑exposure vulnerability (CWE-200) and does not directly enable code execution or privilege escalation.

The affected system is HCL Software’s HCL AION platform. Specific affected product versions are not disclosed in the available data, so any deployment of HCL AION remains potentially impacted until a vendor update is applied.

The CVSS score of 4.2 indicates low severity. No EPSS data is available and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is network/web, with an attacker attempting to trick the application into loading malicious cross-origin content. Given the missing COEP header, the exploitation condition requires that the application would embed a malicious resource; the vulnerability alone does not grant direct access but weakens isolation safeguards.