What’s Vulnerable › Vulnerabilities
CVE-2026-110475: Improper Authentication Vulnerability in CreditNirvana Collections Platform
- Severity: critical (CVSS 9.3 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-10-26 · updated 2026-10-26
- Weakness: CWE-1390
Description
This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing APIs without a valid authenticated session on the targeted system. Successful exploitation of this vulnerability could allow the attacker to enumerate platform users, establish sessions as arbitrary users including administrative users, access and modify sensitive information with the privileges of the impersonated user.
Summary
CVE-2026-110475 is a critical (CVSS 9.3) improper authentication and authorization flaw in the login service of the CreditNirvana Collections Platform (CollectionWorkz). An unauthenticated remote attacker can manipulate authentication requests to reach APIs without a valid session, enabling user enumeration, session establishment as arbitrary users including administrators, and access or modification of sensitive data with the impersonated user's privileges. The flaw affects the CreditNirvana Collections Platform (CollectionWorkz); no specific fixed version is identified in the available information, and it is not listed in CISA KEV, so exploitation has not been confirmed. Apply the vendor's authentication fix or patch as soon as it is available, and in the interim restrict network access to the login service and APIs and monitor for anomalous authentication activity.
تُعد CVE-2026-110475 ثغرة حرجة (CVSS 9.3) في المصادقة والتفويض في خدمة تسجيل الدخول بمنصة CreditNirvana Collections Platform (CollectionWorkz). يستطيع مهاجم بعيد غير مصادَق عليه التلاعب بطلبات المصادقة والوصول إلى واجهات API دون جلسة صالحة، ما يتيح حصر مستخدمي المنصة وإنشاء جلسات بهوية مستخدمين عشوائيين بمن فيهم المسؤولون، والوصول إلى معلومات حساسة أو تعديلها بصلاحيات المستخدم المنتحَل. تتأثر المنصة (CollectionWorkz)، ولا يحدد المعلومات المتاحة إصدارًا مُصلَحًا محددًا، ولم تُدرَج الثغرة في CISA KEV ما يعني عدم تأكيد استغلالها. طبّق تحديث المصادقة من المورّد فور توفره، وإلى حين ذلك قيّد الوصول الشبكي إلى خدمة تسجيل الدخول وواجهات API وراقب أي نشاط مصادقة غير طبيعي.
Affected products
- CreditNirvana Collections Platform (CollectionWorkz): All versions prior to 4.8.2
References
Get alerted when CVE-2026-110475 or the next vulnerability affects your stack