Vulnerability · Published Oct 26, 2026 · Assigned by CERT-In

CVE-2026-110474Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre application

High 8.7

In plain English

A high-severity security flaw in Agentic AI Call Centre from CreditNirvana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

Affected products (as reported)

Vendor	Product	Versions
CreditNirvana	Agentic AI Call Centre	All versions prior to 2.0.0

Weakness: CWE-321 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523 third-party-advisory