TaxHacker CVE-2026-78062

Exploitation requires that the target TaxHacker deployment was started without the BETTER_AUTH_SECRET environment variable explicitly set, causing envSchema.parse in lib/config.ts to use the hard-coded fallback JWT signing key embedded in the source code. Because the source is publicly available on GitHub, the fallback secret value is known to any attacker. No authentication, special network position, or user interaction is required - exploitation is fully remote and unauthenticated against any misconfigured instance reachable over the network. Exploitation is limited to TaxHacker versions 0.8.2 and earlier. Deployments where the operator explicitly configured a strong, unique BETTER_AUTH_SECRET value are not vulnerable to JWT forgery via this path.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation with no prior authentication, which is the worst-case access posture. However, the provided impact ratings (VC:L/VI:L/VA:L) appear conservative for an authentication bypass in a financial data application - a successful token forgery grants full impersonation of any account, including administrative ones, suggesting confidentiality and integrity impacts closer to High rather than Low. This discrepancy should be verified against the actual scope of data accessible post-exploitation. EPSS data was not supplied, but the E:P flag indicates proof-of-concept code exists, raising the realistic exploitation likelihood above baseline. No CISA KEV listing is present, so active widespread exploitation is not confirmed. The real-world risk is primarily scoped by deployment footprint: TaxHacker is a niche self-hosted application, limiting the total exposed population. However, the combination of a publicly known secret in open-source code, network-accessible exploitation, and no available patch makes every unpatched instance with a default-configured secret a trivially exploitable target - any operator who deployed without explicitly setting BETTER_AUTH_SECRET is fully exposed with no compensating control short of disabling the service.

An attacker locates a publicly accessible TaxHacker instance and retrieves the hard-coded default BETTER_AUTH_SECRET value directly from the open-source repository on GitHub. Using this known secret, the attacker crafts a JWT token with an arbitrary subject claim (e.g., targeting an administrator account) and submits it to the application's authenticated endpoints, gaining full access to all tax records, financial documents, and account management functions without ever supplying a valid password. Since E:P indicates proof-of-concept code exists, this attack can be executed with widely available JWT manipulation tooling.