EUVD-2026-44921
GHSA-c44q-ff9x-p4wj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable auth bypass yielding full account access, so C:H/I:H and PR:N/UI:N per the described mechanism, but account takeover does not inherently impair availability, so A:N (SSVC 'partial impact' supports downgrading the vendor's A:H).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.
AnalysisAI
Account takeover in HCL DFXAnalytics version 3.0 and below allows a remote attacker to intercept and alter server HTTP responses to defeat client-side authentication or authorization checks and gain unauthorized access to targeted user accounts. HCL rated the flaw critical (CVSS 9.8), but there is no public exploit identified at time of analysis and EPSS is low at 0.16% (6th percentile), with CISA's SSVC framework marking exploitation as none and technical impact as only partial. The weakness class is authentication bypass (CWE-294), where trust in unverified/manipulable response data lets an attacker forge an authenticated state.
Technical ContextAI
HCL DFXAnalytics is an HCL Software analytics product; the single affected CPE is cpe:2.3:a:hcl_software:dfxanalytics:*. The vulnerability is categorized as CWE-294 (Authentication Bypass by Capture-replay / manipulation of authentication data). In practice, 'Account Takeover via Response Manipulation' means the application makes authentication or authorization decisions based on the content of the server's HTTP response as evaluated by the client, rather than enforcing those decisions server-side. By capturing and modifying that response (for example flipping a failure/deny indicator to a success/allow value) before the client application consumes it, the attacker can trick the client into treating the session as authenticated or privileged. The root cause is trusting client-observable, attacker-modifiable response data as the authority for access control.
RemediationAI
Upgrade to a fixed DFXAnalytics release above 3.0 as directed by HCL; the EUVD data lists 'version 3.0 and below' as vulnerable, but no exact patched version number is provided in the available data, so consult the HCL knowledge base advisory (KB0131787 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0131787) for the specific remediated build - Patch available per vendor advisory. Until the fixed version is deployed, compensating controls include enforcing all authentication and authorization decisions server-side so that a manipulated response cannot grant access (removing any client-side trust in success/deny flags), and restricting network exposure of the DFXAnalytics application to trusted networks or VPN to reduce an attacker's ability to interpose on HTTP traffic; the trade-off of network restriction is reduced accessibility for legitimate remote users. Because the exact fix version is not confirmed in the input, verify the target build with HCL support before scheduling the upgrade rather than inventing a version number.
More in Dfxanalytics
View allDenial of service in HCL DFXAnalytics version 3.0 and below allows remote unauthenticated attackers to crash or hang the
Cleartext-adjacent data exposure in HCL DFXAnalytics (version 3.0 and below) stems from continued support for the deprec
Cross-Site Request Forgery exposure in HCL DFXAnalytics arises because session cookies generated during authentication a
HCL DFXAnalytics exposes internal file system paths and directory structure through unhandled error messages, system log
Login replay vulnerability in HCL DFXAnalytics enables a remote attacker in a man-in-the-middle network position to capt
HCL DFXAnalytics fails to enforce strict Content-Security-Policy (CSP) directives for object-src and base-uri, enabling
Session cookie exposure in HCL DFXAnalytics (version 3.0 and below) occurs because authentication-generated cookies are
Internal IP address disclosure in HCL DFXAnalytics (version 3.0 and below) exposes internal network topology data embedd
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers w
HCL DFXAnalytics transmits sensitive data over the network without encryption, allowing network-positioned attackers to
Insecure file permissions on the HCL DFMPro (for CATIA), DFXAnalytics, and DFXServer installer executables allow any loc
Missing HSTS header in HCL DFXAnalytics exposes authenticated sessions to protocol downgrade and man-in-the-middle attac
Same weakness CWE-294 – Authentication Bypass by Capture-replay
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today