CVE-2026-78062: Hard-coded Credentials in vas3k TaxHacker

This vulnerability affects the envSchema.parse function in the lib/config.ts file of the JWT Secret Handler component in vas3k TaxHacker up to version 0.8.2. Manipulating the BETTER_AUTH_SECRET argument leads to the use of hard-coded credentials, which can be exploited remotely without authentication or user interaction. The CVSS 4.0 base score is 6.9, indicating medium severity. Although the vendor has not responded publicly, a patch is available. The product is cloud-hosted, so vendor-managed remediation is expected.

Exploitation of this vulnerability allows an attacker to leverage hard-coded credentials remotely, potentially compromising authentication mechanisms related to JWT secrets. This could lead to unauthorized access or privilege escalation within the affected service. The CVSS score of 6.9 reflects a medium impact with low attack complexity and no required privileges or user interaction.

A patch is available for this vulnerability. Since vas3k TaxHacker is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory or support channels that the patch has been applied. No additional mitigation steps are indicated by the vendor at this time.