Agentic Ai Call Centre
Monthly
CreditNirvana's Agentic AI Call Centre ships a hardcoded static API key inside its client-side JavaScript bundle, so anyone who can reach the application can download the bundle, extract the key and use it to call the application API. The result is remote, unauthenticated read-only exposure of call transcripts and recordings (CWE-321); integrity and availability are unaffected. The reporting source is CERT-In and the priority signal places it in the 'this week' handling window; no public exploit code or confirmed active exploitation was identified at time of analysis.
CreditNirvana's Agentic AI Call Centre ships a hardcoded static API key inside its client-side JavaScript bundle, so anyone who can reach the application can download the bundle, extract the key and use it to call the application API. The result is remote, unauthenticated read-only exposure of call transcripts and recordings (CWE-321); integrity and availability are unaffected. The reporting source is CERT-In and the priority signal places it in the 'this week' handling window; no public exploit code or confirmed active exploitation was identified at time of analysis.