CVE-2026-78062

HighCVSS 7.3

Published: 23/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 23/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.

Risk Assessment

An attacker can exploit hard-coded credentials to gain unauthorized access to the system, potentially leading to data confidentiality breaches and system integrity compromise.

Recommendation

Immediately replace hard-coded credentials with secure, configurable values and monitor the project for updates.

Other vulnerabilities in vas3k TaxHacker

CVE-2026-78061Medium
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.

Original NVD description (English source)

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.