CVE-2026-110474: Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

Published Oct 26, 2026

Updated

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

Affected Software

1 affected component

CreditNirvana Agentic AI Call Centre

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade CreditNirvana Agentic AI Call Centre to a version that resolves this vulnerability.
Fixed in 2.0.0

Event History

Oct 26, 2026

CVE Published

via MITRE·12:08 PM

Data Sourced

via MITRE·12:08 PM

RemedyDescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated remote attacker who can download the application's client-side JavaScript files can extract the hardcoded API key and use it against the targeted system's application API.

What data could be exposed through the extracted key?

The extracted API key could allow arbitrary API calls to retrieve call transcripts and recordings from the targeted system.

CVE-2026-110474: Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed through the extracted key?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data could be exposed through the extracted key?