CVE-2025-59873 PUBLISHED

Session Token Exposure via URL Query Parameters

Assigner: HCL
Reserved: 22.09.2025 Published: 23.02.2026 Updated: 23.02.2026

An information exposure vulnerability exists in

Vulnerability in HCL Software ZIE for Web.

The application transmits sensitive session tokens and authentication identifiers within the URL query parameters . An attacker who gains access to any network log or operates a site linked from the application can hijack user sessions

This issue affects ZIE for Web: v16.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS Score: 5.9

Product Status

Vendor HCL Software
Product ZIE for Web
Versions Default: unaffected
  • Version v16 is affected

References