The vulnerability in HCL AION arises from the application trusting the HTTP Host header value without validation. An attacker can send a request with a crafted Host header to influence URLs, redirects or responses that the application generates, potentially causing phishing redirects, content injection or other unintended behavior that can compromise confidentiality, integrity or availability.

The flaw affects HCL Software's HCL AION platform. All versions that have not applied the vendor's fix are vulnerable. Specific affected versions are not provided in the CVE, so administrators should consult HCL's support documentation to confirm whether their instance is impacted.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, meaning the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness remotely over the network by sending HTTP requests with a malicious Host header where the application uses that header to construct links or redirects, and mitigation should therefore be performed promptly.