CVE-2026-78062
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The function envSchema.parse in lib/config.ts uses hard-coded credentials via the BETTER_AUTH_SECRET argument. The attack can be initiated remotely. The project was informed but has not responded.
Risk Assessment
An attacker can exploit hard-coded credentials to gain unauthorized access to the system, potentially leading to data confidentiality breaches and system integrity compromise.
Recommendation
Immediately replace hard-coded credentials with secure, configurable values and monitor the project for updates.
Other vulnerabilities in vas3k TaxHacker
See all- CVE-2026-94039High
A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.
- CVE-2026-78061Medium
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. The function buildImapConfig in lib/email-sync/imap-client.ts is vulnerable to server-side request forgery via manipulation of host/port arguments. The attack can be launched remotely. A pull request to fix this issue awaits acceptance.
Original NVD description (English source)
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS