CVE-2025-52623

LOW

HCL AION 2.0 - Insufficiently Protected Credentials via Password Field Autocomplete

Title source: llm

Description

HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.

References (1)

Core 1

Core References

Vendor Advisory

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127972

Scores

CVSS v3 3.7

EPSS 0.0015

EPSS Percentile 4.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-522

Status published

Products (2)

hcltech/aion 2.0

hcltech/aion 2.0.0

Published Feb 03, 2026

Tracked Since Feb 18, 2026