CVE-2026-21849

HCL AION has an account lockout mechanism that does not sufficiently restrict repeated failed login attempts. An attacker could make a large number of password guesses against a user account.

HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity. An unattended authenticated session could be used by another person with access to the same system to view information or perform actions on behalf of the user, potentially resulting in unintended behavior or security impact under certain conditions.

HCL AION reveals internal server file system paths in certain application responses. This information could help an attacker understand the application structure and plan further attacks.

In HCL AION, browser autocomplete was enabled on sensitive login form fields, allowing the browser to store and suggest previously entered values. A malicious user with access to the same browser or system could retrieve saved credentials.

HCL AION trusts the HTTP Host header value supplied in requests without validation. An attacker could manipulate this header to influence links, redirects, or responses generated by the application.

HCL AION was missing the Content-Security-Policy (CSP) security response header in application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and content-injection attacks.

HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web interface. The connection used the unencrypted ws:// protocol instead of an encrypted wss:// channel.

HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.

HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.

HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.