Hard-coded Credential Vulnerability in TaxHacker

A vulnerability (CVE-2026-78062) has been identified in the TaxHacker project, specifically within versions up to 0.8.2. The vulnerability resides in the JWT Secret Handler component, located in the lib/config.ts file. The envSchema.parse function improperly handles the BETTER_AUTH_SECRET argument, resulting in the usage of hard-coded credentials for authentication secrets. An attacker can exploit this remotely to bypass authentication mechanisms or forge JWTs. The issue was disclosed via a GitHub issue report, but as of the publication date, the maintainers have not issued a patch. Defenders should treat this as a high-risk exposure if TaxHacker is deployed in production environments where JWT security is critical.

Impact

Successful exploitation of this vulnerability allows an unauthenticated remote attacker to gain access to hard-coded secrets. In the context of a JWT Secret Handler, this typically leads to the ability to forge, sign, or decrypt JSON Web Tokens, potentially resulting in unauthorized administrative access, privilege escalation, or data exfiltration across systems relying on these tokens for identity verification.

Recommendation

Prioritized, concrete actions for security teams:

• Audit all deployments of TaxHacker to confirm the version is 0.8.2 or earlier.
• Implement strict network segmentation or Web Application Firewall (WAF) rules to restrict access to the TaxHacker application if it cannot be immediately patched or removed.
• Monitor application logs for anomalous requests to endpoints that handle authentication or token generation until the vendor releases a fix.
• Check the project repository (https://github.com/vas3k/TaxHacker/issues/147) for updates on a vendor-provided fix or manual workarounds.