---
id: CVE-2026-110474
title: >-
  Hardcoded API Key Vulnerability in CreditNirvana Agentic AI Call Centre
  application
summary: >-
  This vulnerability exists in the CreditNirvana Agentic AI Call Centre
  application due to hardcoded static API Key in the client side JavaScript
  bundle. An unauthenticated remote attacker could exploit this vulnerability by
  downloading cl…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-321
vendor: CreditNirvana
product: Agentic AI Call Centre
affected:
  - agentic_ai_call_centre All versions prior to 2.0.0
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T12:24:07.042Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-110474'
references:
  - url: >-
      https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2026-0523
tags:
  - cve.org
ingestedAt: '2026-10-26T14:27:31.839Z'
epss: 0.00371
epssPercentile: 0.30888
---

## Overview

This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in the client side JavaScript bundle. An unauthenticated remote attacker could exploit this vulnerability by downloading client side JavaScript files and extracting API key, which could lead to make arbitrary API calls to retrieve call transcripts and recordings through the application API of the targeted system.

## Affected

- `agentic_ai_call_centre All versions prior to 2.0.0`

## Remediation

Upgrade CreditNirvana Agentic AI Call Centre to latest version 2.0.0