CreditNirvana Collections Platform: Improper authentication allows session takeover
Summary
The CreditNirvana Collections Platform (CollectionWorkz) has improper authentication and authorization controls at its login service. An unauthenticated remote attacker can manipulate authentication requests and access APIs without a valid session. Successful exploitation allows user enumeration, impersonation of any user including administrators, and access to or modification of sensitive data.
Affected
- CreditNirvana Collections Platform (CollectionWorkz) versions prior to 4.8.2
- Default configuration: unaffected (according to CERT-In)
Fixed in
- Upgrade to version 4.8.2 or later (CERT-In recommendation)
- Vendor patch statement: Unknown.
Workaround
- No vendor-documented workaround is known.
- Interim measures: Unknown.
- General measures: restrict access to login and API endpoints to known networks or a VPN, and review admin logins and sessions for unusual activity.
Exploitation
- Not listed as known exploited (as of 30 Oct 2026).
- VulDB reports no exploit exists at the time of its entry.
- No public proof of concept found in the research; not checked in detail.
Our recommendation
- Ask collection partners and lenders whether they use CreditNirvana and whether they run version 4.8.2 or later.
- If you operate the platform yourself, upgrade to 4.8.2 or later and review logs and admin sessions first.
- Confirm the fix directly with the vendor, as no vendor security bulletin was found.
- Monitor for unusual logins and session activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT-In advisory CIVN-2026-0523 www.cert-in.org.in
- CVE record mirror (threatint) cve.threatint.com
- OpenCVE entry app.opencve.io
- VulDB entry 426422 vuldb.com
- HOL Guard CVE entry hol.org
- OffSeq Radar threat entry radar.offseq.com
- Strix AI CVE entry www.strix.ai
- CreditNirvana product announcement (Yahoo Finance) finance.yahoo.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:44.
Original description (NVD)
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.