What’s Vulnerable › Vulnerabilities

CVE-2026-78062: vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-23 · updated 2026-10-12
• Weakness: CWE-259

Description

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Affected products

• vas3k TaxHacker: 0.8.0, 0.8.1, 0.8.2

References

• https://github.com/vas3k/TaxHacker/
• https://github.com/vas3k/TaxHacker/issues/147
• https://vuldb.com/cve/CVE-2026-78062
• https://vuldb.com/submit/881826
• https://vuldb.com/vuln/394302
• https://vuldb.com/vuln/394302/cti

Get alerted when CVE-2026-78062 or the next vulnerability affects your stack