CVE-2026-78062 PUBLISHED

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

• keyblue (VulDB User) reporter
• VulDB CNA Team coordinator

• VDB-394302 | vas3k TaxHacker JWT Secret config.ts envSchema.parse hard-coded credentials
• VDB-394302 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-78062 | CVE Analysis and Report
• Submit #881826 | vas3k TaxHacker main Use of Weak Credentials
• https://github.com/vas3k/TaxHacker/issues/147
• https://github.com/vas3k/TaxHacker/

• Hard-coded Credentials CWE
• Use of Hard-coded Password CWE