CreditNirvana Agentic AI Call Centre: Hard-coded API key in client-side JavaScript
Summary
The CreditNirvana Agentic AI Call Centre application contains a static API key hard-coded in its client-side JavaScript bundle. An unauthenticated remote attacker can download these JavaScript files, extract the key and use it to make arbitrary API calls. This can expose call transcripts and recordings, which may contain customer and financial information.
Affected
- CreditNirvana Agentic AI Call Centre, all versions prior to 2.0.0
Fixed in
- Version 2.0.0
Workaround
Unknown.
Exploitation
- No known exploitation in the wild.
- Not listed in CISA KEV.
- No public proof of concept found.
- EPSS about 0.37%.
Our recommendation
- Upgrade to version 2.0.0 or later.
- Treat the old key as compromised: rotate it, confirm it is rejected, and review API logs for calls made with it.
- Ask the vendor or provider whether the 2.0.0 build still uses the key.
- Check whether the call centre application or its API is reachable from the internet, or hosted for you by a provider.
- Identify any recordings or transcripts with customer data that may have been exposed, and assess obligations under the Swiss FADP.
- Also check the related CVE-2026-110475 if you run CreditNirvana Collections Platform (fixed in 4.8.2).
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT-In advisory CIVN-2026-0523 www.cert-in.org.in
- OpenCVE CVE-2026-110474 app.opencve.io
- VulDB 426419 vuldb.com
- HOL Guard CVE-2026-110474 hol.org
- Strix CVE-2026-110474 www.strix.ai
- OffSeq Radar CVE-2026-110474 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:12.
Original description (NVD)
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.