Improper Authentication in CreditNirvana Collections Platform
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
The CreditNirvana Collections Platform has improper authentication and authorization controls at its platform login service. An unauthenticated remote attacker can manipulate authentication requests and access APIs without a valid authenticated session. Successful exploitation lets the attacker enumerate platform users, establish sessions as arbitrary users including administrators, and access and modify sensitive information with the privileges of the impersonated user.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| CreditNirvana | CreditNirvana Collections Platform (CollectionWorkz) | before 4.8.2 | 4.8.2 | Patch available | CNA |
- CreditNirvana Collections Platform (CollectionWorkz) VendorCreditNirvana Affected before 4.8.2 Fixed in 4.8.2 Patch available CNA
Remediation
The sources list no fixed version for CreditNirvana Collections Platform (CollectionWorkz).
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA CreditNirvana Collections Platform (CollectionWorkz) (CreditNirvana) Fixed in 4.8.2
Timeline
- 2026-10-26 Threatist record created from CVE-2026-110475
- 2026-10-27 Alias added: GHSA-84f2-894g-2279
- 2026-11-02 CISA SSVC decision points changed
References
More CreditNirvana vulnerabilities
- TI-2026-80362 Hardcoded API key in CreditNirvana Agentic AI Call Centre exposes recordings CVSS 4.0HIGH 8.7
Sources
- CVE-2026-110475 · CVE Program
- CVE-2026-110475 · NVD
- FIRST EPSS
- GHSA-84f2-894g-2279 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences