A vulnerability in HCL AION allows authenticated user sessions to remain active indefinitely when a sufficient period of inactivity passes. If an unattended session remains active, another user with access to the same system can view information or perform actions on behalf of the original user, potentially leading to unintended behavior or security impact under certain conditions.

HCL Software’s HCL AION product. No specific version information is provided in the advisory; the vulnerability is presumed to affect all installed instances of the product until a fix is applied.

The CVSS score of 3.3 indicates a low severity risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local and requires another person with access to the same system to hijack an idle session. Because the flaw only persists in shared or unattended environments, the overall likelihood of exploitation is low, but if exploited it allows for unauthorized access to user data or actions within the application.