Threats tagged 'ghsa-72fh-w73q-9x49'

The CreditNirvana Agentic AI Call Centre application contains a vulnerability due to a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. With the extracted key, the attacker could make arbitrary API calls to access sensitive call transcripts and recordings through the application's API.