HighVulnerability
CVE-2026-110474: CreditNirvana Agentic AI Call Centre hardcoded API key in client-side JavaScript
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-110474
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
CVE-2026-110474 affects the CreditNirvana Agentic AI Call Centre application. A static API key is hardcoded in its client-side JavaScript bundle, so an unauthenticated remote attacker can download those files and extract the key. The attacker could then make arbitrary API calls to retrieve call transcripts and recordings.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Topics
Related items
- LowStolen AI Reasoning Could Help China Build Cheaper RivalsSimilar attack · SecurityWeek
- InfoBeyond membership inference: Distributional leakage in diffusion modelsSimilar attack · Elsevier Security Journals
- LowThe AI notetaker risk is now an everywhere problemSimilar attack · CSO Online
- InfoLabel-Budgeted Attribute Inference from Protected Features in Edge-Cloud Split Multimodal LLMsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- LowTRACE: Data-Free Text Reconstruction Attacks against Approximate Unlearning in LLMsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)