What happened
A hardcoded static API key embedded in the client-side JavaScript bundle of the CreditNirvana Agentic AI Call Centre can be extracted by an unauthenticated attacker, granting access to protected backend functionality. CERT-IN advisory CIVN-2026-0523; CVSS 8.7, published 2026-10-26.
Why it matters
The application is an agentic AI call-centre product, and the exposed key likely protects the LLM/agent backend or telephony APIs; a client-side secret gives an unauthenticated user a route into the protected AI service layer.
Attack vector
An unauthenticated attacker downloads the client-side JavaScript bundle, extracts the static API key, and uses it to call backend APIs or services that rely on that key for authentication.
Affected systems
CreditNirvana Agentic AI Call Centre application (client-side JavaScript bundle).
Mitigation
Rotate the exposed API key and move the key out of the client bundle to a server-side proxy / short-lived token; apply authz on the backend rather than relying on a client-embedded secret.