CVE-2026-94040

A Server-Side Request Forgery (SSRF) vulnerability exists in vas3k TaxHacker up to version 0.8.5 . The flaw is in the function testLLMProviderAction within the file app/(app)/apps/settings/actions.ts. Remote, unauthenticated attackers can manipulate the provider , apiKey , model , and baseUrl arg...