CVE-2025-52628
Published: 03 February 2026
Summary
CVE-2025-52628 is a medium-severity Sensitive Cookie with Improper SameSite Attribute (CWE-1275) vulnerability in Hcltech Aion. Its CVSS base score is 4.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-23 (Session Authenticity).
Deeper analysis
CVE-2025-52628, published on 2026-02-03, is a Cookie with Insecure, Improper, or Missing SameSite vulnerability (CWE-1275) affecting HCL AION version 2.0. This flaw allows cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery (CSRF) and related security risks. The vulnerability has a CVSS v3.1 base score of 4.6 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L), indicating medium severity with network accessibility, low attack complexity, and requirements for low privileges and user interaction.
Exploitation requires an attacker to have low privileges (PR:L) and relies on user interaction (UI:R), such as tricking an authenticated victim into initiating a cross-site request from a malicious site. Successful attacks can achieve low impacts on integrity (I:L) and availability (A:L), with no confidentiality impact (C:N), enabling scenarios like unauthorized actions performed on the victim's behalf due to improper cookie handling.
HCL provides mitigation guidance in its support knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0127972.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206688
Vulnerability details
HCL AION is affected by a Cookie with Insecure, Improper, or Missing SameSite vulnerability. This can allow cookies to be sent in cross-site requests, potentially increasing exposure to cross-site request forgery and related security risks. This issue affects AION: 2.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing SameSite cookie attribute directly enables cross-site request forgery against the public-facing HCL AION web application, matching the definition of T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires protection of session authenticity, which is defeated when cookies lack the SameSite attribute and can be sent cross-site.
Enforces that access decisions are based on valid, same-origin authenticated sessions rather than forged cross-site requests carrying cookies.
Requires validation of incoming requests (e.g., origin or token checks) to block actions performed via improperly scoped cookies.