PT-2026-3469 · Hcl · Hcl Aion Version 2

Published 2026-01-19 · Updated 2026-01-19 · CVE-2025-52661

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions HCL AION version 2

Description HCL AION version 2 is susceptible to a JWT Token Expiry Too Long issue. This could elevate the risk of token misuse, potentially leading to unauthorized access if a token is compromised. The JWT (JSON Web Token) standard is used for securely transmitting information between parties as a JSON object. A long expiry time for the token increases the window of opportunity for malicious actors to exploit a compromised token.

Recommendations Ensure the JWT token expiry time is appropriately configured to minimize the risk of unauthorized access.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-52661

Affected Products

Hcl Aion Version 2

References · 4

• https://support.hcl-software.com/kb_view.do?sys_kb_id=4b92474633de7ad4159a05273e5c7b4b&searchTerm=kb0127995# · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52661 · Security Note
• https://twitter.com/CVEnew/status/2013316906380394909 · Twitter Post