CVE-2026-36727
The vulnerability allows attackers to forge a JSON Web Token and bypass authentication on the /api/social-sign-in endpoint of bookcars version 8.3. This means anyone can log in as any user without knowing a password. The flaw is serious because it can be exploited over the network without any special access.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
bookcars v8.3, the web application that uses the /api/social-sign-in endpoint.
Real-world impact
An attacker can create a forged JWT token and use it to authenticate as any user, gaining full access to that user's account and any data or actions the account is allowed to perform.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely (AV:N), requires no special privileges (PR:N), needs no user interaction (UI:N), and gives the attacker full confidentiality and integrity compromise (C:H, I:H). The low attack complexity and lack of required permissions make it highly dangerous.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jun 9, 2026 · Jun 9, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.