EUVD-2026-46346
GHSA-m9wm-8hw7-wg6x
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable but requires a pre-obtained valid session token (PR:L, AC:H); impact is confined to limited confidentiality disclosure with no integrity or availability consequence.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse.
AnalysisAI
Concurrent Login Vulnerability in HCL MyCloud permits authenticated users to sustain multiple simultaneous active sessions without invalidation, enabling session hijacking and unauthorized account access. The CVSS score of 3.1 (Low) reflects high attack complexity, a prerequisite of authenticated access, and impact confined to partial confidentiality - no integrity or availability impact applies. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
Technical ContextAI
HCL MyCloud (cpe:2.3:a:hclsoftware:mycloud:*:*:*:*:*:*:*:*) is an enterprise cloud collaboration and file-sharing platform from HCL Software. The root cause is CWE-613 (Insufficient Session Expiration), which covers failures to properly invalidate session tokens when new login events occur or when sessions should otherwise expire. In this case, the platform fails to enforce single-session constraints or to terminate older sessions upon concurrent authentication, allowing valid session tokens to persist beyond their intended scope. This design gap means a stolen or intercepted token remains exploitable even while the legitimate user is concurrently authenticated, expanding the window of unauthorized access.
RemediationAI
Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132381 for official patch guidance and exact fixed version numbers, as no specific patched release is confirmed from the available intelligence data. As compensating controls pending patch deployment, administrators should enforce single active session policies that invalidate all prior sessions upon a new successful login event, preventing parallel token abuse. Session timeout windows should be shortened to reduce the viable lifetime of any intercepted token. Enabling concurrent session anomaly detection - such as alerting on simultaneous logins from geographically disparate IPs - can surface active abuse. Enforcing multi-factor authentication increases the difficulty of leveraging stolen credentials or tokens to maintain unauthorized concurrent sessions. Note that aggressive session expiration policies may degrade the experience for legitimate users operating across multiple devices simultaneously.
Weak password policy enforcement in HCL MyCloud exposes authenticated accounts to brute-force and credential-stuffing at
HCL MyCloud leaks license keys in HTTP responses, enabling authenticated low-privilege users who can observe or intercep
TLS session confidentiality in HCL MyCloud is undermined by the LUCKY13 padding oracle vulnerability, enabling a network
Session cookie exposure in HCL MyCloud arises from the cookie Path attribute not being set, causing authentication token
HCL MyCloud ships a bundled IIS Server component containing publicly disclosed vulnerabilities, classified under CWE-110
Server version disclosure in HCL MyCloud exposes software version strings - likely via HTTP response headers or applicat
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today