EUVD-2026-64631
GHSA-c2p7-hcxm-xqhj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable JWT forgery requires no privileges; scope changes because all user accounts are impersonable, yielding high confidentiality and integrity impact with no availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in vas3k TaxHacker up to 0.8.2. The affected element is the function envSchema.parse of the file lib/config.ts of the component JWT Secret Handler. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Authentication bypass in vas3k TaxHacker through version 0.8.2 is possible because the JWT Secret Handler in lib/config.ts falls back to a hard-coded value for BETTER_AUTH_SECRET when the environment variable is not explicitly set at deployment. Because TaxHacker is open-source on GitHub, the default secret is publicly readable, enabling any remote unauthenticated attacker to forge valid JWT tokens and impersonate arbitrary users - including administrators - against any misconfigured instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target TaxHacker deployment was started without the `BETTER_AUTH_SECRET` environment variable explicitly set, causing `envSchema.parse` in `lib/config.ts` to use the hard-coded fallback JWT signing key embedded in the source code. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable, zero-complexity exploitation with no prior authentication, which is the worst-case access posture. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker locates a publicly accessible TaxHacker instance and retrieves the hard-coded default `BETTER_AUTH_SECRET` value directly from the open-source repository on GitHub. Using this known secret, the attacker crafts a JWT token with an arbitrary subject claim (e.g., targeting an administrator account) and submits it to the application's authenticated endpoints, gaining full access to all tax records, financial documents, and account management functions without ever supplying a valid password. … |
| Remediation | No vendor-released patch has been identified at time of analysis; the project maintainer has not responded to the GitHub disclosure issue #147. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today