CVE-2026-94040

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...

EUVD-2026-83759

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...

CVE-2026-94040

A Server-Side Request Forgery (SSRF) vulnerability exists in vas3k TaxHacker up to version 0.8.5 . The flaw is in the function testLLMProviderAction within the file app/(app)/apps/settings/actions.ts. Remote, unauthenticated attackers can manipulate the provider , apiKey , model , and baseUrl arg...

CVE-2026-94040 vas3k TaxHacker actions.ts testLLMProviderAction server-side request forgery

A flaw has been found in vas3k TaxHacker up to 0.8.5. Affected by this vulnerability is the function testLLMProviderAction of the file app/app/apps/settings/actions.ts. Executing a manipulation of the argument provider/apiKey/model/baseUrl can lead to server-side request forgery. The attack may b...