HCL AION has a security issue where the browser autocomplete feature is unintentionally enabled on sensitive login form fields, causing the browser to store and propose entered credentials. A malicious actor with access to the same browser or system can retrieve these saved credentials, potentially leading to unintended behavior or security impacts under certain conditions. Such a flaw is identified as CWE-522, representing the mismanagement of stored credentials.

The vulnerability affects installations of HCL Software’s HCL AION. No specific product versions are mentioned, so the issue applies to all known releases until an official statement is issued.

The CVSS score is 3.3, indicating a low severity assessment. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. The likely attack vector is local; an attacker must gain access to the same browser or system that has stored the credentials. Because of the absence of advanced exploitation conditions, the probability of widespread exploitation remains low.