CVE-2026-110474 PUBLISHED

Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

Assigner: CERT-In
Reserved: 14.10.2026 Published: 26.10.2026 Updated: 26.10.2026

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	CreditNirvana
Product	Agentic AI Call Centre
Versions	Default: unaffected Version All versions prior to 2.0.0 is affected

Solutions

Upgrade CreditNirvana Agentic AI Call Centre to latest version 2.0.0

Credits

This vulnerability is reported by Eaton Zveare. finder

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523

Problem Types

CWE-321 Use of hard-coded cryptographic key CWE

Impacts

CAPEC-191 Read Sensitive Constants Within an Executable