CVE-2026-78061

MediumCVSS 6.3

Published: 23/08/2026(UTC)Updated: 24/08/2026(UTC)Translated: 23/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.28%

19th percentile - higher than 19% of all known CVEs

Summary

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.

Risk Assessment

An attacker can exploit SSRF to access internal network resources, potentially leading to data leakage or further attacks.

Recommendation

Monitor the pull request status and apply the fix when available, and restrict access to the service.

Other vulnerabilities in vas3k TaxHacker

CVE-2026-78062High
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.

Original NVD description (English source)

A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.