Vulnerability · Published Oct 26, 2026 · Assigned by CERT-In

CVE-2026-110475Improper Authentication Vulnerability in CreditNirvana Collections Platform

Critical 9.3

In plain English

A critical-severity security flaw in CreditNirvana Collections Platform (CollectionWorkz) from CreditNirvana. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.5%top 58.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

Affected products (as reported)

Vendor	Product	Versions
CreditNirvana	CreditNirvana Collections Platform (CollectionWorkz)	All versions prior to 4.8.2

Weakness: CWE-1390 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523 third-party-advisory