CVE-2025-52628
Unknown Unknown - Not Provided
Insecure SameSite Cookie in HCL AION 2.0 Enables CSRF

Publication date: 2026-02-03

Last updated on: 2026-04-25

Assigner: HCL Software

Description
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-03
Last Modified
2026-04-25
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-14
NVD
CVE-2025-52628
EUVD
EUVD-2025-206688
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hcltech aion 2.0.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1275 The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The vulnerability in HCL AION involves cookies that have insecure, improper, or missing SameSite attributes. This means that cookies can be sent along with cross-site requests, which should normally be restricted. As a result, this increases the risk of cross-site request forgery (CSRF) attacks and other related security issues.

Impact Analysis

This vulnerability can allow attackers to perform cross-site request forgery attacks by exploiting cookies sent in cross-site requests. This can lead to unauthorized actions being performed on behalf of a user, potentially compromising the integrity and availability of the affected system.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-52628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart