CVE-2026-78062: vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTERAUTHSECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vas3k TaxHackerto a version that resolves this vulnerability.Fixed in 0.8.2 - Configuration
Modify envSchema.parse in lib/config.ts so BETTER_AUTH_SECRET cannot lead to hard-coded credentials; ensure secrets are sourced securely and validated before use.
JWT Secret Handler (lib/config.ts) BETTER_AUTH_SECRET handling = Ensure BETTER_AUTH_SECRET is not used to derive hard-coded credentials; validate/sanitize and load secrets securely from environment/secret store - Compensating control
Since the attack can be initiated remotely, restrict network access to the TaxHacker service (e.g., limit inbound access to only trusted IPs) until the fix is applied.
- Operational
Rotate any credentials/secrets potentially exposed via the hard-coded credentials behavior of BETTER_AUTH_SECRET after applying the fix.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects vas3k TaxHacker versions up to and including 0.8.2, in the JWT Secret Handler's use of BETTER_AUTH_SECRET through envSchema.parse in lib/config.ts.
Can this be exploited remotely without an account?
Yes. The supplied vector indicates network-based exploitation with low attack complexity, no required privileges, and no user interaction.
What security impact is reported?
The reported impact includes partial loss of confidentiality, integrity, and availability. The vulnerability is rated high with a 7.3 severity score.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of the report.