The vulnerability in TaxHacker permits an attacker to manipulate the BETTER_AUTH_SECRET environment value when the envSchema.parse function in lib/config.ts processes the JWT Secret Handler, resulting in the use of hard‑coded credentials. This flaw can allow remote authentication to succeed without valid user credentials, thereby exposing internal resources to unauthorized users. The loss of confidentiality and integrity is inherent if the attacker can impersonate legitimate users.

The affected product is vas3k TaxHacker up to version 0.8.2. The specific component impacted is the JWT Secret Handler located in lib/config.ts. The vulnerability only exists in this version range and is not present in later releases if any have been issued.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, so the probability of exploitation is unknown but it can be initiated remotely, which increases the risk. The vulnerability is not listed in CISA KEV and no public exploit data is referenced. Since the issue can be triggered from outside the system, attackers with network access may supply a crafted BETTER_AUTH_SECRET to gain unauthenticated access. In the absence of a published patch, the risk remains until the development team resolves the hard‑coded credential logic.