CVE-2026-110475

Improper Authentication Vulnerability in CreditNirvana Collections Platform

Assigner: CERT-In
Reserved: 14.10.2026 Published: 26.10.2026 Updated: 26.10.2026

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	CreditNirvana
Product	CreditNirvana Collections Platform (CollectionWorkz)
Versions	Default: unaffected Version All versions prior to 4.8.2 is affected

Vendor

CreditNirvana

Product

CreditNirvana Collections Platform (CollectionWorkz)

Versions

Default: unaffected

Version All versions prior to 4.8.2 is affected

Solutions

Upgrade CreditNirvana Collections Platform to latest version 4.8.2

Credits

This vulnerability is reported by Eaton Zveare. finder

References

Problem Types

CWE-1390 Weak Authentication CWE