CVE-2026-110474

Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

State: Published
Severity: 8.7 High
Published: Oct 26, 2026
Updated: Oct 26, 2026
Reserved: Oct 14, 2026

Description

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	CERT-In

Weaknesses

CWE-321 Use of hard-coded cryptographic key

Affected Products

Product	Versions
Agentic AI Call CentreCreditNirvana	All versions prior to 2.0.0Affected

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523third-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.