CVE-2026-78062

CVE-2026-78062 targets envSchema.parse in lib/config.ts, which processes the BETTER_AUTH_SECRET environment variable used for JWT token signing. The CVE is labeled as 'hard-coded credentials,' but this classification obscures the actual issue: the schema validation likely does not enforce BETTER_AUTH_SECRET as a required, non-empty value. When the environment variable is absent or weak, the application may fall back to a predictable default rather than rejecting the configuration outright. This is categorically different from hard-coded credentials. A hard-coded credential is a static value you can revoke. A predictable fallback from missing validation is a logic vulnerability that exists in the absence of any credential—there is nothing to revoke because the secret was never actually configured. The real risk: if the JWT handler accepts tokens signed with this fallback, an attacker can forge authentication tokens, escalate privileges, or impersonate users without needing to manipulate the environment. This is exploitation through omission, not injection. The project has not responded to the issue report, meaning no patch is forthcoming and downstream users have no official guidance. Verify your deployments by checking whether BETTER_AUTH_SECRET is explicitly configured—absent configuration may not fail safely. Test whether the JWT handler rejects authentication attempts when no valid secret exists, or if it proceeds with a default. Standard secrets scanners will not flag this because the secret is correctly externalized to an environment variable; behavioral testing is required instead. The EPSS score of 0.00495 reflects current obscurity, but TaxHacker appears to function as a template project. If its authentication patterns propagate through forks or dependencies, this becomes exploitable infrastructure regardless of the EPSS calculation.

Reviewed through automated stages and approved by a human before publication.