Zero Radar
← feed
CriticalVulnerabilityCVE-2026-110475updated 26 Oct 2026, 16:57 UTC

CreditNirvana Collections Platform: attackers can log in as any user, including admins

Someone on the internet without a password can trick the platform's login system into treating them as a real user, including an administrator. They can then read and change sensitive records.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Unauthenticated attackerNo password or account needed
  2. 2Login service flawRequests accepted without valid session
  3. 3Session as any userIncludes administrative accounts
  4. 4Sensitive data accessRead and modify with impersonated privileges
  5. ResultAttacker takes over accounts and data

What happened

The CreditNirvana Collections Platform has improper authentication and authorization checks at its login service, letting unauthenticated remote attackers call APIs without a valid session.

Why it is dangerous: An attacker could list platform users, take over sessions of arbitrary users including administrators, and access or modify sensitive collections data with those privileges.

Are you affected?

You are affected if you run the CreditNirvana Collections Platform with its login service exposed to the network.

CreditNirvana Collections Platform (specific versions not stated in the available material)

What to do

  1. Confirm whether your instance of the CreditNirvana Collections Platform is in use and where it is reachable from
  2. Restrict network access to the platform and its login service until a fix is confirmed
  3. Check the vendor or the GitHub advisory (GHSA-84f2-894g-2279) for a patched version and apply it
  4. Review logs for unexpected logins, user enumeration, or changes to sensitive records

Timeline

  1. 26 Oct 2026, 14:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 14:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 14:21 UTC
    Picked up by Zero Radar
  4. 26 Oct 2026, 16:57 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-110475 · GHSA-84f2-894g-2279
CVSS
9.3 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 14:16 UTC
On Zero Radar
26 Oct 2026, 14:21 UTC (5 min after disclosure)
Last change
26 Oct 2026, 16:57 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

CreditNirvana Collections Platform: attackers can log in as any user, including admins · Zero Radar