---
id: "CVE-2026-110475"
kind: "vulnerability"
aliases: ["CVE-2026-110475"]
title: "CreditNirvana Collections Platform: login flaw lets attackers impersonate any user"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["collections-platform", "creditnirvana", "other"]
not_affected_if: []
published_at: "2026-10-26T14:16:26+00:00"
first_seen_at: "2026-10-26T14:30:36+00:00"
updated_at: "2026-10-26T14:32:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110475", "first_seen_at": "2026-10-26T14:30:36+00:00"}]
---

# CreditNirvana Collections Platform: login flaw lets attackers impersonate any user

The CreditNirvana Collections Platform has broken authentication and authorization at its login service, so unauthenticated requests can reach APIs without a valid session. An attacker can enumerate users, start sessions as arbitrary users including administrators, and read or change sensitive data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm whether the CreditNirvana Collections Platform is deployed in your environment and which version is running (unknown from sources)
- Review login service and API access logs for unauthenticated requests or sessions issued to unexpected accounts (unknown from sources)

## Fix

- Unknown: the sources do not name a fixed version or vendor patch; check with the vendor or NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-110475

## Timeline

- 2026-10-26T14:30:36+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110475

## From the sources

This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system.

Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_