The CreditNirvana Agentic AI Call Centre application embeds a static API key directly in the client-side JavaScript bundle. An unauthenticated remote attacker can download these files, extract the key, and then use it to invoke the application’s API. This allows the attacker to retrieve call transcripts and recordings, exposing sensitive communications and potentially violating privacy and regulatory requirements.

The weakness is present in all CreditNirvana Agentic AI Call Centre releases that precede version 2.0.0, as indicated by the vendor’s advisory.

The vulnerability carries a CVSS score of 8.7, indicating a high level of severity. The EPSS score is not reported, and the issue is not listed in the CISA KEV catalog. Attackers do not need authentication; the threat vector is remote via the public web interface. Once the key is obtained, the attacker can make arbitrary API calls to harvest confidential data. Because the exploitation path is straightforward—download the JavaScript, locate the key, and replay requests—the likelihood of exploitation remains significant if the software is left unpatched.