Threat Intelligence Database

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-94039 is a server-side request forgery (SSRF) vulnerability in vas3k TaxHacker versions 0.8.0 through 0.8.5. The flaw exists in the generateInvoicePDF function within the Invoice PDF Renderer component, where manipulation of the businessLogo argument can trigger SSRF. The vulnerability can be exploited remotely. A public exploit is available, but no known active exploitation in the wild has been reported. The vendor has been informed but has not yet responded. A patch is available for this cloud-hosted service.

A vulnerability in vas3k TaxHacker up to version 0.8.2 allows remote attackers to cause hard-coded credentials via manipulation of the BETTER_AUTH_SECRET argument in the JWT Secret Handler component. The issue affects the envSchema.parse function in lib/config.ts. The project has been informed but has not yet responded or issued a fix. The CVSS score is 7.3, indicating a medium severity.

A server-side request forgery (SSRF) vulnerability exists in vas3k TaxHacker up to version 0.8.2 in the buildImapConfig function of the Email Sync component. This vulnerability allows remote attackers to manipulate the host and port arguments, potentially causing the server to make unintended requests. A fix has been developed but is pending acceptance in a pull request. The vulnerability has a CVSS 3.1 score of 6.3, indicating a medium severity level.

CVE-2026-78062 is a medium severity vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. It involves hard-coded credentials due to manipulation of the BETTER_AUTH_SECRET argument in the JWT Secret Handler component. The vulnerability can be exploited remotely. The vendor has not yet responded to the issue report, but a patch is available. The product is a cloud service, so remediation is typically managed by the vendor.

CVE-2026-78061 is a server-side request forgery (SSRF) vulnerability in vas3k TaxHacker affecting versions 0.8.0, 0.8.1, and 0.8.2. The flaw exists in the buildImapConfig function of the Email Sync component, where manipulation of the host or port arguments can lead to SSRF. The vulnerability can be exploited remotely. A patch has been developed but is pending acceptance. The product is a cloud service, so vendor-managed remediation is expected.