EUVD-2026-44907
GHSA-8539-9p7j-q3gf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated network attacker manipulating auth responses (AV:N/PR:N/UI:N); AC:L accepts same-session manipulation, though on-path requirements could justify AC:H; grants access (C:H) with limited integrity impact and no availability loss.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.
AnalysisAI
Authentication bypass in HCL DFXServer lets an unauthenticated remote attacker intercept and tamper with the server's authentication responses to be granted access as a legitimate user without presenting valid credentials. Rated CVSS 8.2 (high) with CWE-294 (Authentication Bypass by Capture-replay), the flaw exposes confidential application data to any network-reachable attacker. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
HCL DFXServer is a server-side HCL Software application whose client-server authentication logic trusts the outcome encoded in the server's authentication response rather than binding the session to a verified secret. CWE-294 (Authentication Bypass by Capture-replay) describes exactly this root-cause class: an authentication decision that can be captured, replayed, or altered because it is not cryptographically protected or freshly validated. In practice a client-side or on-path attacker who can observe and rewrite the response that signals 'authentication succeeded/failed' can flip a denial into an approval. The only CPE provided, cpe:2.3:a:hcl_software:dfxserver:*:*:*:*:*:*:*:*, covers all versions and does not pin a fixed release, so the exact affected build range must be confirmed from the vendor KB.
RemediationAI
Consult the HCL Software knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782 and apply the vendor's fixed release for DFXServer; no exact fix version is present in the provided data, so treat 'Patch available per vendor advisory' as the current status and confirm the target version directly with HCL. Until patched, reduce exposure by restricting network reachability of the DFXServer authentication endpoint to trusted management networks or VPN only (trade-off: breaks access for remote/off-network users), enforcing TLS with strict certificate validation end-to-end so authentication responses cannot be transparently intercepted or rewritten on the wire (trade-off: requires clients that pin/validate certificates), and placing the service behind a reverse proxy or WAF that terminates and re-validates sessions server-side (trade-off: adds latency and does not fix a client-trust bypass if the attacker operates within their own session). Monitor authentication logs for successful logins lacking a corresponding credential validation event.
Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly
Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity
HCL DFXServer permits client connections over plaintext HTTP, exposing all transmitted data to interception by any attac
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today