CreditNirvana Collections Platform CVE-2026-110475

No special conditions - remote unauthenticated exploitation against the login service and APIs of the CreditNirvana Collections Platform (CollectionWorkz), consistent with AV:N/AC:L/PR:N/UI:N; the attacker only needs network reachability to the platform's authentication endpoint and crafts manipulated authentication requests. The description names no required feature flag, non-default configuration, or user interaction. The practical limiting factors are that the targeted instance must be network/internet-reachable to the attacker and that this is a niche, industry-specific product, so the exposed population is small; the exact affected versions are not stated in the available data.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. All available severity signals align: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw with no attack requirements and no user interaction, scoring 9.3, and the vuln.today decision label is 'act_now' - the strongest urgency signal in the input. CWE-1390 (weak/improper authentication) is fully consistent with the description of an authentication-and-authorization bypass at the login service. The impact metrics (VC:H/VI:H, VA:N) match the description's claim that an attacker can read and modify sensitive data as an impersonated user but implies no availability loss. Counterbalancing signals: there is no EPSS score, no CISA KEV listing (CERT-In, an Indian national CERT, is the reporter rather than CISA), and no public exploit reference in the input, so there is currently no public exploit identified - the elevated urgency rests on the ease and impact of exploitation plus vendor/CERT reporting, not on observed in-the-wild activity. The practical risk is therefore concentrated on internet-exposed deployments of this specific product; organizations running CreditNirvana CollectionWorkz should treat it as act-now, while the absence of exploitation telemetry means widespread opportunistic exploitation has not been demonstrated.

A remote, unauthenticated attacker who can reach the CreditNirvana CollectionWorkz login service sends manipulated authentication requests to the platform's APIs, bypassing session validation to establish a session as an arbitrary user - including an administrator. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network access and no credentials, user interaction, or special timing. No public exploit is identified in the available data, so exploitation would require the attacker to independently develop the request manipulation.