CVE-2025-52628
Unknown Unknown - Not Provided

Insecure SameSite Cookie in HCL AION 2.0 Enables CSRF

Publication date: 2026-02-03

Last updated on: 2026-04-25

Assigner: HCL Software

Description
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-03
Last Modified
2026-04-25
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-04
NVD
CVE-2025-52628
EUVD
EUVD-2025-206688

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hcltech aion 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1275 The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The vulnerability in HCL AION involves cookies that have insecure, improper, or missing SameSite attributes. This means that cookies can be sent along with cross-site requests, which should normally be restricted. As a result, this increases the risk of cross-site request forgery (CSRF) attacks and other related security issues.

Impact Analysis

This vulnerability can allow attackers to perform cross-site request forgery attacks by exploiting cookies sent in cross-site requests. This can lead to unauthorized actions being performed on behalf of a user, potentially compromising the integrity and availability of the affected system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-52628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart