CVE-2025-59870
HighSummary
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation, introducing a security risk.
Risk Assessment
The static JWT secret could be compromised, allowing an attacker to forge tokens and gain unauthorized access to the system.
Recommendation
It is recommended to implement a JWT secret rotation mechanism and immediately change the current secret to a new, randomly generated one.
Other vulnerabilities in HCL MyXalytics
See all- CVE-2025-52657Low
HCL MyXalytics is affected by a potential DoS vulnerability. It allows users to input data without any restriction on the number of characters, which can impact system performance or availability.
- CVE-2025-52652Low
HCL MyXalytics is affected by a Content Spoofing vulnerability. It may allow an attacker to manipulate displayed content, making it appear as though it originates from a trusted source, potentially leading to phishing or data theft.
- CVE-2025-52651Low
HCL MyXalytics is affected by an improper input validation vulnerability. It allows malicious or unexpected data to cause unintended system behavior or security issues.
Original NVD description (English source)
HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk