CVE-2025-59870

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-59870", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "state": "PUBLISHED", "assignerShortName": "HCL", "dateReserved": "2025-09-22T15:00:11.103Z", "datePublished": "2026-01-16T10:12:01.499Z", "dateUpdated": "2026-01-21T11:12:41.559Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MyXalytics", "vendor": "HCL Software", "versions": [{"lessThan": "6.7", "status": "affected", "version": "6.2", "versionType": "custom"}]}], "datePublic": "2026-01-16T10:01:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">HCL MyXalytics&nbsp; is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk</span>"}], "value": "HCL MyXalytics\u00a0 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk"}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-01-21T11:12:41.559Z"}, "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128115"}], "source": {"discovery": "UNKNOWN"}, "title": "Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-323", "lang": "en", "description": "CWE-323 Reusing a Nonce, Key Pair in Encryption"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T12:12:28.762228Z", "id": "CVE-2025-59870", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T12:18:05.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-59870", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-16T12:12:28.762228Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-323", "description": "CWE-323 Reusing a Nonce, Key Pair in Encryption"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T12:12:34.680Z"}}], "cna": {"title": "Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HCL Software", "product": "MyXalytics", "versions": [{"status": "affected", "version": "6.2", "versionType": "custom", "lessThanOrEqual": "6.7"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-16T10:01:00.000Z", "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128115"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "HCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">HCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk</span>", "base64": false}]}], "providerMetadata": {"orgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "shortName": "HCL", "dateUpdated": "2026-01-16T10:12:01.499Z"}}}, "cveMetadata": {"cveId": "CVE-2025-59870", "state": "PUBLISHED", "dateUpdated": "2026-01-16T12:18:05.838Z", "dateReserved": "2025-09-22T15:00:11.103Z", "assignerOrgId": "1e47fe04-f25f-42fa-b674-36de2c5e3cfc", "datePublished": "2026-01-16T10:12:01.499Z", "assignerShortName": "HCL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MyXalytics", "vendor": "HCL Software", "versions": [{"lessThan": "6.7", "status": "affected", "version": "6.2", "versionType": "custom"}]}], "source": "psirt@hcl.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hcltech:myxalytics:6.2:*:*:*:*:*:*:*", "matchCriteriaId": "0C6F2615-0B25-4465-BE38-714313C9062F", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:myxalytics:6.3:*:*:*:*:*:*:*", "matchCriteriaId": "79D5EDA2-6774-4B8A-A3AC-659FFC139B5F", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:myxalytics:6.4:*:*:*:*:*:*:*", "matchCriteriaId": "8533B38F-22F2-4D0E-8276-6B8F86D826C4", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:myxalytics:6.5:*:*:*:*:*:*:*", "matchCriteriaId": "0774CC44-C753-433F-85C3-9934FEE6BC1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:myxalytics:6.6:*:*:*:*:*:*:*", "matchCriteriaId": "20B1E85F-A207-4692-A491-8DAE3D00654F", "vulnerable": true}, {"criteria": "cpe:2.3:a:hcltech:myxalytics:6.7:*:*:*:*:*:*:*", "matchCriteriaId": "2858C304-AFAB-4ECA-96F0-C90A97F7A2DC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL MyXalytics\u00a0 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk"}, {"lang": "es", "value": "HCL MyXalytics se ve afectado por la gesti\u00f3n inadecuada de un secreto de firma JWT est\u00e1tico en la aplicaci\u00f3n web, donde el secreto carece de rotaci\u00f3n, introduciendo un riesgo de seguridad."}], "id": "CVE-2025-59870", "lastModified": "2026-06-17T09:46:49.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "psirt@hcl.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-59870", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T12:12:28.762228Z", "version": "2.0.3"}}]}, "published": "2026-01-16T11:16:02.660", "references": [{"source": "psirt@hcl.com", "tags": ["Vendor Advisory"], "url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0128115"}], "sourceIdentifier": "psirt@hcl.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-323"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"created": "2026-01-16T13:41:38.850112+00:00", "updated": "2026-01-16T13:41:38.850138+00:00", "vendors": ["hcltech", "hcltech$PRODUCT$myxalytics"]}