CVE-2026-35104

HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The redirect performed after registration used the value of the 'redirect' query parameter without validation, so a crafted registration link could send a user to an untrusted external site. This may be used in phishing attacks, potentially resulting in unintended behavior or security impact under certain conditions.

• CWE-601

• https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0135118

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35096KTM System e-BOK is vulnerable to Cross‑Site Request Forgery…5.1
• CVE-2026-35097KTM System e-BOK enforces a maximum password length of six n…6.9
• CVE-2026-35098KTM System e-BOK does not implement any limit or timeout on …6.9
• CVE-2026-35099Lakeside SysTrack Agent 11 before 11.5.0.15 has a race condi…7.4
• CVE-2026-35102HCL AION is affected by an open redirect vulnerability in th…4.7
• CVE-2026-35103HCL AION is affected by an open redirect vulnerability on th…4.7
• CVE-2026-35105HCL AION is affected by an open redirect vulnerability in th…4.7
• CVE-2026-35106HCL AION is affected by an open redirect vulnerability in th…4.7
• CVE-2026-35107HCL AION is affected by an open redirect vulnerability in th…4.7
• CVE-2026-35109HCL AION is affected by a vulnerability where pages served o…3.7
• CVE-2026-3511Improper Restriction of XML External Entity Reference vulner…8.6
• CVE-2026-35110HCL AION is affected by a vulnerability where encrypted (HTT…5.4