This vulnerability is caused by HCL AION missing or improperly configuring the Cross‑Origin‑Opener‑Policy header. The inadequacy of the header permits documents from other origins to share the same browsing context window with the application, which can enable cross‑window or cross‑tab attacks. Successful exploitation may allow an attacker to perform unintended actions within the application, potentially exposing sensitive data or manipulating the user session.

Affected systems are HCL Software’s HCL AION platform. No specific product versions are listed in the CVE information; all releases prior to the vendor‑provided fix should be treated as vulnerable.

The CVSS score of 4.8 indicates medium severity. EPSS data is not available and the vulnerability is not included in CISA’s KEV catalog, suggesting that widespread exploitation has not been observed. The likely attack vector involves an attacker delivering a malicious page that shares a browsing context with the vulnerable AION instance – this requires the user to visit the attacker’s site while the application is open. Once the context is shared, the attacker could attempt cross‑window attacks such as DOM manipulation or credential theft, depending on the application's behavior.