CVE-2026-110474

CreditNirvana AI Call Centre exposes an API key in client JavaScript

CreditNirvana · Agentic AI Call Centre

First documented disclosure · Review checkpoint

Summary

A static key shipped to browsers can allow unauthenticated retrieval of call transcripts and recordings.

Severity and exploitation evidence

High · 8.7/10 · CVSS 4.0. Severity source.

Exploitation not established: Real-world malicious exploitation is not established by the reviewed primary sources; a vulnerability report or public demonstration is not evidence of a victim incident.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The client JavaScript bundle contains an API credential accepted by application APIs.

Conditions required

Network access to an affected application and its publicly downloadable client files; no authenticated user session is required by the advisory.

Potential impact

Unauthorized access to call transcripts and audio recordings. The separate Collections Platform impersonation issue in the same bulletin is not part of this CVE.

Affected versions and configurations

All versions before 2.0.0.

Fix and mitigation status

2.0.0.

Practical next steps

Upgrade to 2.0.0 or later; additionally verify removal and rotation of exposed keys and review access logs for misuse.

Operating lesson

A credential sent to a browser cannot serve as a secret authorization boundary for AI conversation records.

Evidence and limits

CERT-In’s original bulletin and CNA record are dated October 26 and credit Eaton Zveare. Neither establishes a malicious victim incident. Key-rotation and log-review advice here is an operational recommendation beyond the bulletin’s upgrade instruction.

Sources