HCL AION contains an issue where the account lockout mechanism does not sufficiently restrict repeated failed login attempts, allowing an attacker to make a large number of password guesses against a user account. This weakness can increase the risk of account compromise through brute‑force attacks, potentially leading to unintended behavior or a security impact if conditions are met. The weakness corresponds to CWE‑307, Improper Restriction of Excessive Authentication Attempts.

The affected IT platform is HCL Software's HCL AION. No specific product versions are listed in the available data, so any deployment of HCL AION that predates the relevant patch is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA's KEV catalog. The most likely attack path involves repeatedly attempting logins through the authentication interface, possibly from remote systems, exploiting the lack of lockout to enumerate valid credentials.