CVE-2025-59870 (GCVE-0-2025-59870)

Vulnerability from cvelistv5 – Published: 2026-01-16 10:12 – Updated: 2026-01-21 11:12
VLAI
Title
Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
Summary
HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-323 - Reusing a Nonce, Key Pair in Encryption
Assigner
HCL
References
Impacted products
Vendor Product Version
HCL Software MyXalytics Affected: 6.2 , < 6.7 (custom)
Create a notification for this product.
Date Public
2026-01-16 10:01
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59870",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-16T12:12:28.762228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-323",
                "description": "CWE-323 Reusing a Nonce, Key Pair in Encryption",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-16T12:18:05.838Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "MyXalytics",
          "vendor": "HCL Software",
          "versions": [
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2026-01-16T10:01:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eHCL MyXalytics\u0026nbsp; is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk\u003c/span\u003e"
            }
          ],
          "value": "HCL MyXalytics\u00a0 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-21T11:12:41.559Z",
        "orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
        "shortName": "HCL"
      },
      "references": [
        {
          "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128115"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc",
    "assignerShortName": "HCL",
    "cveId": "CVE-2025-59870",
    "datePublished": "2026-01-16T10:12:01.499Z",
    "dateReserved": "2025-09-22T15:00:11.103Z",
    "dateUpdated": "2026-01-21T11:12:41.559Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-59870",
      "date": "2026-06-30",
      "epss": "0.00236",
      "percentile": "0.14501"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-59870\",\"sourceIdentifier\":\"psirt@hcl.com\",\"published\":\"2026-01-16T11:16:02.660\",\"lastModified\":\"2026-06-17T09:46:49.440\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"HCL MyXalytics\u00a0 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk\"},{\"lang\":\"es\",\"value\":\"HCL MyXalytics se ve afectado por la gesti\u00f3n inadecuada de un secreto de firma JWT est\u00e1tico en la aplicaci\u00f3n web, donde el secreto carece de rotaci\u00f3n, introduciendo un riesgo de seguridad.\"}],\"affected\":[{\"source\":\"psirt@hcl.com\",\"affectedData\":[{\"vendor\":\"HCL Software\",\"product\":\"MyXalytics\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"6.2\",\"lessThan\":\"6.7\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@hcl.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":5.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-01-16T12:12:28.762228Z\",\"id\":\"CVE-2025-59870\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-323\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hcltech:myxalytics:6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C6F2615-0B25-4465-BE38-714313C9062F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hcltech:myxalytics:6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79D5EDA2-6774-4B8A-A3AC-659FFC139B5F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hcltech:myxalytics:6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8533B38F-22F2-4D0E-8276-6B8F86D826C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hcltech:myxalytics:6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0774CC44-C753-433F-85C3-9934FEE6BC1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hcltech:myxalytics:6.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"20B1E85F-A207-4692-A491-8DAE3D00654F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:hcltech:myxalytics:6.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2858C304-AFAB-4ECA-96F0-C90A97F7A2DC\"}]}]}],\"references\":[{\"url\":\"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128115\",\"source\":\"psirt@hcl.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-59870\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-16T12:12:28.762228Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-323\", \"description\": \"CWE-323 Reusing a Nonce, Key Pair in Encryption\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-16T12:12:34.680Z\"}}], \"cna\": {\"title\": \"Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.4, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"HCL Software\", \"product\": \"MyXalytics\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.2\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-01-16T10:01:00.000Z\", \"references\": [{\"url\": \"https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128115\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"HCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eHCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk\u003c/span\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"1e47fe04-f25f-42fa-b674-36de2c5e3cfc\", \"shortName\": \"HCL\", \"dateUpdated\": \"2026-01-16T10:12:01.499Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-59870\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-16T12:18:05.838Z\", \"dateReserved\": \"2025-09-22T15:00:11.103Z\", \"assignerOrgId\": \"1e47fe04-f25f-42fa-b674-36de2c5e3cfc\", \"datePublished\": \"2026-01-16T10:12:01.499Z\", \"assignerShortName\": \"HCL\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.