CreditNirvana CVE-2026-110474 and CVE-2026-110475: What Indian Organizations Should Check

Introduction

Short answer:** CERT-In reported two high-severity CreditNirvana product vulnerabilities on 26 October 2026. CVE-2026-110474 involves a hardcoded API key in the Agentic AI Call Centre client-side JavaScript bundle, while CVE-2026-110475 involves improper authentication in the Collections Platform. CERT-In says affected versions should be upgraded to Agentic AI Call Centre 2.0.0 and CollectionWorkz 4.8.2.

**Key takeaways**

- The advisory concerns two different products and two different control failures.

- A client-side API key should be treated as exposed, not as a secret.

- Improper authentication can lead to user enumeration, impersonation and unauthorized data changes.

- Organizations should review API logs, sessions and access patterns after identifying an affected deployment.

- The article discusses defensive response and does not claim that every CreditNirvana customer was compromised.

What did CERT-In report?

CERT-In’s CIVN-2026-0523 describes vulnerabilities in the CreditNirvana Agentic AI Call Centre and Collections Platform. The first issue is a hardcoded static API key in a client-side JavaScript bundle. Because browser-delivered code is accessible to users and attackers, values embedded there should not be relied on as confidential credentials.

The second issue is an authentication and authorization weakness in the platform login service. CERT-In says an unauthenticated attacker could manipulate authentication requests and access APIs without a valid session, potentially reaching sensitive information or modifying data with impersonated privileges.

Why is a client-side API key risky?

A key shipped to a browser can be downloaded, inspected and reused. It may help an attacker call backend endpoints outside the intended user interface, depending on server-side controls. The fix is not simply hiding the key in minified JavaScript; sensitive authorization decisions must be enforced by the server and scoped to an authenticated, authorized request.

Organizations should review whether the affected application exposes API keys, bearer tokens or internal endpoint details in browser bundles. This is a broader secure-development lesson that applies to web applications used in financial services, customer support and AI-enabled operations.

What does the authentication issue mean?

Improper authentication can make the platform treat an untrusted request as an authenticated session. CERT-In describes possible user enumeration, arbitrary session establishment, access to sensitive information and unauthorized modification of application data. The exact impact on a deployment depends on version, configuration, tenant separation and the records exposed.

Security teams should not test these behaviors against a live system without authorization. Instead, use vendor guidance, an approved test environment and controlled log review to determine whether suspicious access occurred.

What should affected organizations do?

Upgrade the Agentic AI Call Centre to version 2.0.0 and CollectionWorkz to version 4.8.2, as listed by CERT-In. Before and after the update, document the deployed versions, backup and rollback plan, exposed interfaces and administrator accounts. Rotate any credentials or keys that may have been exposed through client-side code or suspicious sessions.

Review authentication logs, API access logs, session creation, privilege changes, transcript or recording access and unusual data exports. If evidence suggests unauthorized access, preserve the relevant records and follow the organization’s incident-response and reporting process.

India-focused governance and privacy checks

Organizations using customer call data should connect the technical response with their internal privacy, retention and access-control requirements. A vulnerability advisory does not by itself determine legal liability, but it should prompt a documented review of what information the platform stores, who can access it and whether the organization’s response obligations have been triggered.

Limit administrative access, enforce strong session controls, keep tenant boundaries explicit and monitor privileged API operations. These controls remain useful even after patching because they reduce the blast radius of future application flaws.

FAQs

### Were all CreditNirvana customers breached?

No. CERT-In’s advisory describes vulnerabilities and potential impact. It does not establish that every customer was compromised.

### What versions should be installed?

CERT-In lists Agentic AI Call Centre 2.0.0 and Collections Platform CollectionWorkz 4.8.2 as the upgrade targets.

### Is an API key in JavaScript secret?

No. Anything delivered to a browser should be considered discoverable. Sensitive authorization must be enforced server-side.

Conclusion

The CreditNirvana advisory shows why application security, API security and authentication controls must be reviewed together. Confirm whether either affected product is deployed, upgrade to the versions listed by CERT-In, rotate exposed credentials and review access logs for suspicious activity.

Limitations

• Reporting channels, procedures and security guidance can change; verify current instructions before acting.

Evidence sources

1. cert-in.org.in — CERT-In CIVN-2026-0523
2. creditnirvana.ai — CreditNirvana
3. cve.org — CVE-2026-110474 Record
4. cve.org — CVE-2026-110475 Record