Live › vulnerability › CVE-2026-110474
Go to dashboardThe CreditNirvana Agentic AI Call Centre ships a static API key inside its client-side JavaScript bundle. Anyone who downloads those files can extract the key and call the application API to retrieve call transcripts and recordings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Any deployment of the CreditNirvana Agentic AI Call Centre whose client-side JavaScript contains the static API key is exposed, because the key is reachable by anyone who loads the page. Teams running the product should check their own deployed bundles. unknown whether any other configuration can skip it.
No product ranges from the sources yet.
grep -i "api[_-]key" bundle.jsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.
This page as .md · .json · in your agent: get_signal("CVE-2026-110474")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.