Live › vulnerability › CVE-2026-110475
Go to dashboardThe CreditNirvana Collections Platform has broken authentication and authorization at its login service, so unauthenticated requests can reach APIs without a valid session. An attacker can enumerate users, start sessions as arbitrary users including administrators, and read or change sensitive data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 14:30 UTC. All times on this page are UTC.
Teams that run the CreditNirvana Collections Platform with its login service exposed to the network are affected, since the flaw lets unauthenticated remote requests reach APIs. The sources do not describe other conditions, so whether teams without this product can skip it is unknown.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.
Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
This page as .md · .json · in your agent: get_signal("CVE-2026-110475")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.