CVE-2025-55266

Published: Mar 26, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

HCL Aftermarket DPC is affected by Session Fixation which allows attacker to takeover the user's session and use it carry out unauthorized transaction behalf of the user.

Affected (1)

Products: Hcltech: Aftermarket Cloud

Hcltech

1 product

Aftermarket Cloud

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hcltech Aftermarket Cloud	Version 1.0.0

Related CWEs

CWE-384

Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

References (1)

https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793

Source: psirt@hcl.com

Vendor Advisory

Timeline

No history available yet.