HCL MyXalytics Static JWT Signing Secret Management Vulnerability

A vulnerability exists in HCL MyXalytics versions 6.7, 6.6, 6.5, 6.4, 6.3, and 6.2 due to improper management of a static JSON Web Token (JWT) signing secret. The secret does not undergo regular rotation, creating a security risk.

Impact

This vulnerability could lead to unauthorized access or manipulation of JWTs, potentially allowing for impersonation or other malicious actions within the application.

Remediation

Users must upgrade to HCL MyXalytics version 6.7 to address this vulnerability. The HCL MyXalytics support team is available to assist with the upgrade process.