EUVD-2026-44907
GHSA-8539-9p7j-q3gf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Unauthenticated network attacker manipulating auth responses (AV:N/PR:N/UI:N); AC:L accepts same-session manipulation, though on-path requirements could justify AC:H; grants access (C:H) with limited integrity impact and no availability loss.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
HCL DFXServer is affected by an Authentication Bypass vulnerability via server response manipulation. An unauthorized user without valid credentials can exploit this flaw by intercepting and altering the server's authentication responses, allowing them to gain unauthorized access to the application without verification.
AnalysisAI
Authentication bypass in HCL DFXServer lets an unauthenticated remote attacker intercept and tamper with the server's authentication responses to be granted access as a legitimate user without presenting valid credentials. Rated CVSS 8.2 (high) with CWE-294 (Authentication Bypass by Capture-replay), the flaw exposes confidential application data to any network-reachable attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to intercept and modify the server's authentication response messages exchanged with DFXServer - the specific precondition named in the description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are moderately consistent toward a real but not mass-exploitation priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with network access to DFXServer routes their client traffic through an intercepting proxy, submits a login attempt with no or invalid credentials, and rewrites the server's 'authentication failed' response into a 'success' response before the client processes it. Because the client trusts the response outcome, the attacker is admitted to the application and can read confidential data. … |
| Remediation | Consult the HCL Software knowledge base article at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131782 and apply the vendor's fixed release for DFXServer; no exact fix version is present in the provided data, so treat 'Patch available per vendor advisory' as the current status and confirm the target version directly with HCL. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all HCL DFXServer instances and their network exposure; classify data sensitivity of each system; begin network isolation or access restriction where operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Authentication bypass in HCL DFXServer allows remote unauthenticated attackers to reach specific API endpoints directly
Unauthenticated API access in HCL DFXServer exposes application endpoints to any network-reachable user without identity
HCL DFXServer permits client connections over plaintext HTTP, exposing all transmitted data to interception by any attac
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today