Description

A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-23T05:16:52.137Z",
  "pubdate": "2026-08-23T05:16:52.137Z",
  "executiveSummary": "A hard-coded credentials vulnerability has been identified in vas3k TaxHacker up to version 0.8.2, specifically within the JWT Secret Handler component. The flaw resides in the envSchema.parse function located in the file lib/config.ts, where the manipulation of the argument BETTER_AUTH_SECRET exposes the application to hard-coded secret risks. This security defect allows remote attackers to compromise cryptographic token validation mechanisms, potentially leading to unauthorized access and session forgery. The vulnerability presents significant risk implications for authentication integrity across affected deployments. Exploitation can be initiated remotely without requiring prior authentication or specialized privileges, provided the attacker can interact with the vulnerable application configuration boundaries. The project maintainers were notified via an early issue report but have not yet provided a response or official patch.",
  "technicalDetails": "The vulnerability stems from improper management of cryptographic secrets within the configuration parsing logic of vas3k TaxHacker up to version 0.8.2. Specifically, the vulnerable component is the JWT Secret Handler, located in the file lib/config.ts. During initialization and runtime configuration loading, the function envSchema.parse processes environment variables and application settings.\nThe root cause involves the presence or improper handling of hard-coded credentials associated with the argument BETTER_AUTH_SECRET. In secure architectures, JSON Web Token (JWT) secrets and authentication keys must be dynamically generated, uniquely provisioned per instance, and loaded securely from isolated environment stores. However, the affected implementation improperly handles or embeds default fallback values for BETTER_AUTH_SECRET, permitting predictable or static cryptographic signing material.\nThe attack flow initiates remotely across network boundaries where the application is exposed. An unauthenticated remote attacker who identifies or forces the use of the default hard-coded secret can construct forged JSON Web Tokens. Because the application relies on the statically defined or predictable BETTER_AUTH_SECRET processed by envSchema.parse, the signature verification check successfully validates malicious tokens crafted by the attacker.\nPost-exploitation impact includes complete bypass of authentication controls, unauthorized access to sensitive user sessions, privilege escalation, and potential manipulation of protected backend functionalities. The lack of proper validation and dynamic secret enforcement within lib/config.ts undermines the foundational security guarantees of the JWT implementation in affected versions of the software."
}