HCL AION has a vulnerability where user sessions do not expire after a sufficient period of inactivity. This can allow an unattended authenticated session to be accessed by another person with access to the same system, potentially leading to unauthorized viewing of information or actions performed on behalf of the original user. The vulnerability has a low severity rating and does not indicate direct compromise of data integrity or availability.