CVE-2026-78062 vas3k CVE debrief

Who should care

Defenders responsible for systems using vas3k TaxHacker versions up to 0.8.2 should assess the risk of remote exploitation and prioritize verification and potential mitigation of this vulnerability.

Why it matters

CVE-2026-78062 is a vulnerability in vas3k TaxHacker up to 0.8.2 that allows for hard-coded credentials due to improper handling of the BETTER_AUTH_SECRET argument. Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if using affected versions, and assess the risk of remote exploitation. The vendor has been informed but has not yet responded.

• Remote exploitation of the hard-coded credentials vulnerability
• Potential unauthorized access to systems using vas3k TaxHacker
• Need for verification of affected versions and vendor response
• Priority on patching or mitigating the vulnerability

Technical summary

The vulnerability affects the function envSchema.parse of the file lib/config.ts in vas3k TaxHacker up to 0.8.2. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials, allowing for remote exploitation. Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if using affected versions, and assess the risk of remote exploitation. The project was informed early through an issue report but has not yet responded. There is no information on affected or fixed versions.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their systems, especially if using vas3k TaxHacker versions up to 0.8.2, and assess the risk of remote exploitation.

Recommended defensive actions

• Verify the presence of vas3k TaxHacker versions up to 0.8.2 in your systems
• Assess the risk of remote exploitation of the hard-coded credentials vulnerability
• Monitor for vendor response and potential patches or updates
• Consider implementing compensating controls to mitigate the risk
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability. However, the vendor's response to the issue report is still pending, and there is no information on affected or fixed versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.