CVE-2026-78062
Received Received - Intake

Hard-Coded Credentials in vas3k TaxHacker JWT Secret Handler

Publication date: 2026-08-23

Last updated on: 2026-08-23

Assigner: VulDB

Description
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-23
Last Modified
2026-08-23
Generated
2026-08-23
AI Q&A
2026-08-23
EPSS Evaluated
N/A
NVD
CVE-2026-78062
EUVD
EUVD-2026-64631

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vas3k taxhacker to 0.8.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a hardcoded default JWT secret in the TaxHacker application up to version 0.8.2. The BETTER_AUTH_SECRET environment variable defaults to a weak, publicly known value ('please-set-your-key-here') in the codebase. When not explicitly set during deployment, the system uses this weak default to sign JWT session tokens, allowing attackers to forge valid tokens and bypass authentication.

Detection Guidance

Check if the BETTER_AUTH_SECRET environment variable is set to the default weak value 'please-set-your-key-here' in your TaxHacker deployment. Inspect the .env file and Docker environment variables for this value. Review the lib/config.ts file for the hardcoded default secret in the envSchema.parse function.

Impact Analysis

Attackers can exploit this to impersonate users and gain unauthorized access to the system. This may allow them to access financial data, modify transactions, or export user data. All deployments that did not set a custom BETTER_AUTH_SECRET are affected since the default secret is visible in the public repository.

Compliance Impact

This vulnerability allows attackers to forge JWT tokens and bypass authentication, potentially gaining unauthorized access to sensitive financial data. This could lead to unauthorized data access, modification, or export, violating GDPR's data protection principles and HIPAA's safeguards for protected health information if financial data includes such details.

Mitigation Strategies

Set a strong, unique BETTER_AUTH_SECRET environment variable in your deployment. Remove the default secret from the Zod schema in lib/config.ts. Update the .env.example file with a cryptographically strong default secret. Validate the secret's strength at startup and reject weak or default values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78062. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart