The US Internal Revenue Service is putting tax payers at risk by operating thousands of web servers that contain security vulnerabilities or have not received proper authorization, a new report has concluded.