CVE-2025-52623
Low · 3.7CVSS
3.7
EPSS
0.2%
Published
Feb 3, 2026
CISA due date
—
The record
HCL AION is affected by an Autocomplete HTML Attribute Not Disabled for Password Field vulnerability. This can allow autocomplete on password fields may lead to unintended storage or disclosure of sensitive credentials, potentially increasing the risk of unauthorized access. This issue affects AION: 2.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-104850 MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and… CWE-522
- CVE-2026-91766 When the http:// stream wrapper follows a redirect it forwards the user-supplied… CWE-522
- CVE-2026-64918 Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker… CWE-522
- CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud… CWE-522
- CVE-2026-76969 @sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality… CWE-522
- CVE-2026-86175 NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST… CWE-522
- CVE-2026-53603 nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. CWE-522
- CVE-2026-8862 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded… CWE-522