CVE-2025-59870 is a static JWT signing secret problem in HCL MyXalytics, scored CVSS 7.4 (high). The secret in the web application was never rotated. Confirm the fixed build in HCL's knowledge base article, update, and rotate any related keys on your side.
What's affected
The NVD record names HCL MyXalytics, assigns CWE-323 and lists no version ranges. The description says the web application keeps a static JWT signing secret that lacks rotation.
The HCL support portal did not return article text when I fetched it, so this guide relies on the NVD record. Read the article itself for the fixed version.
How to check if you're exposed
HCL publishes the affected and fixed builds for MyXalytics in its knowledge base article, and that article is the authority. I could not read its text when preparing this guide, so I will not state a fixed version here.
- Find the build you run. The admin or about page of the product usually shows it, and so does your deployment record.
- Open the HCL article listed under Sources and compare your build with its list of affected and fixed builds.
- If the article lists a fix and you are behind it, you are exposed to the issue described here. If your build is not named, ask HCL support to confirm in writing.
Ask HCL whether the fix changes how the signing secret is created or stored, and whether existing tokens remain valid after the update. If it does not rotate secrets in your instance, plan to do it yourself.
What to do now
- Find all MyXalytics deployments and their builds.
- Apply the build HCL names.
- After updating, confirm whether signing keys were regenerated, and rotate them if the product allows.
- Invalidate existing sessions so tokens signed with the old secret stop working.
- Keep signing secrets out of source control and out of images, and store them in a secrets manager.
Why it matters
The class is CWE-323, reusing a nonce or key pair in encryption. In practice the question for a JWT secret is simple: who else knows it. A secret that is fixed, shared across installs, or never changed gives anyone who learns it the ability to mint tokens the application will accept.
That is why the score is high. The remedy is secrets that are unique per deployment, stored safely and rotated on a schedule, so one leak does not last forever.
Quick check
What is a JWT signing secret?
It is the key the server uses to sign login tokens. Anyone holding it can create tokens the server will trust, so it must be unique and protected.
Sources
Last reviewed: 19 October 2026.
