CVE-2026-78062: TaxHacker Auth Bypass Vulnerability

CVE-2026-78062 Overview

CVE-2026-78062 affects vas3k TaxHacker versions up to and including 0.8.2. The vulnerability resides in the envSchema.parse function within lib/config.ts, part of the JWT Secret Handler component. Manipulation of the BETTER_AUTH_SECRET argument leads to hard-coded credentials exposure [CWE-259]. Attackers can initiate the attack remotely across the network without authentication or user interaction. The project maintainers were notified through a public issue report but have not responded at the time of disclosure.

Critical Impact
Hard-coded JWT signing material allows unauthenticated attackers to forge authentication tokens and access protected resources within TaxHacker deployments.

Affected Products

vas3k TaxHacker versions up to 0.8.2
lib/config.ts component containing envSchema.parse
JWT Secret Handler using the BETTER_AUTH_SECRET value

Discovery Timeline

2026-08-23 - CVE-2026-78062 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-78062

Vulnerability Analysis

TaxHacker is an open-source personal accounting and tax tracking application. The application relies on the BETTER_AUTH_SECRET environment variable to sign and verify JSON Web Tokens (JWTs) used for authentication. The vulnerable envSchema.parse function in lib/config.ts accepts or defaults the secret in a way that yields hard-coded credential material rather than requiring a per-deployment, high-entropy secret.

When the JWT signing secret is predictable or shared across installations, an attacker can craft valid tokens for any user identifier. This bypasses standard authentication checks because the server accepts any token signed with the known secret.

The issue is tracked as CWE-259: Use of Hard-coded Password. See the GitHub Issue #147 Discussion for the original public report.

Root Cause

The root cause is insecure default handling of the BETTER_AUTH_SECRET value within the environment schema parser. The configuration layer does not enforce that operators supply a unique, cryptographically strong secret before the application binds to a network interface. As a result, the JWT Secret Handler operates with credential material that is either static in source, shared across deployments, or otherwise recoverable.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker who obtains the hard-coded BETTER_AUTH_SECRET value, whether from the public repository, container images, or documentation, can sign arbitrary JWTs. Those tokens are then presented to the TaxHacker API to impersonate authenticated users or elevate access to sensitive tax and financial records.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose only; refer to the VulDB CVE-2026-78062 Record and the GitHub Repository for TaxHacker for source-level details.

Detection Methods for CVE-2026-78062

Indicators of Compromise

Unexpected successful authentication events for user accounts that did not initiate a login flow.
JWT tokens presented to TaxHacker endpoints whose iat or sub claims do not correspond to a prior interactive login recorded by the application.
Access to accounting or document endpoints from IP addresses outside the expected administrative or user range.

Detection Strategies

Inspect running TaxHacker instances for a BETTER_AUTH_SECRET value that matches the default or example value shipped in the repository or container image.
Audit deployment manifests, .env files, and container environments for reused secret material across environments.
Correlate application authentication logs with reverse proxy access logs to identify token use without corresponding login requests.

Monitoring Recommendations

Alert on any TaxHacker deployment that starts without an operator-supplied BETTER_AUTH_SECRET override.
Monitor GitHub and container registry mirrors of TaxHacker for the presence of static secret values referenced by lib/config.ts.
Track outbound data transfers from TaxHacker hosts to detect bulk export of tax records following anomalous authentication.

How to Mitigate CVE-2026-78062

Immediate Actions Required

Rotate the BETTER_AUTH_SECRET in every TaxHacker deployment to a unique, cryptographically random 256-bit value.
Invalidate all existing JWTs by rotating the secret and forcing users to re-authenticate.
Restrict network exposure of TaxHacker instances to trusted networks or place them behind an authenticating reverse proxy until a vendor fix is available.

Patch Information

At the time of publication, the TaxHacker project has not released a patch or issued a vendor advisory. The maintainer has not responded to GitHub Issue #147 Discussion. Operators should track the GitHub Repository for TaxHacker for future releases beyond version 0.8.2.

Workarounds

Override BETTER_AUTH_SECRET in every environment with a value generated by a secure random source such as openssl rand -base64 48.
Store the secret in a managed secret store rather than committing it to configuration files or container images.
Deploy TaxHacker behind an identity-aware proxy that enforces authentication independently of the application's JWT layer.

bash

# Configuration example: generate and set a strong BETTER_AUTH_SECRET
export BETTER_AUTH_SECRET="$(openssl rand -base64 48)"

# Persist in an environment file with restrictive permissions
umask 077
printf 'BETTER_AUTH_SECRET=%s\n' "$BETTER_AUTH_SECRET" > /etc/taxhacker/.env
chown taxhacker:taxhacker /etc/taxhacker/.env
chmod 600 /etc/taxhacker/.env