CVE-2026-36721
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
Risk Assessment
An attacker can impersonate any user, gaining unauthorized access to application features and data.
Recommendation
Update bookcars to a version that fixes JWT token signature verification.
Other vulnerabilities in bookcars
See all- CVE-2026-36727Critical
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. An attacker can bypass authentication using a forged JWT token.
- CVE-2026-36726Medium
The /api/delete-temp-license/{file} endpoint in bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via directory traversal sequences.
- CVE-2026-36723High
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3. Authenticated attackers can move files from temporary storage to arbitrary locations, enabling access to sensitive files, overwriting critical files, and remote code execution.
- CVE-2026-36722Medium
An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2026-36720High
Insecure permissions in bookcars v8.3 allow authenticated attackers to escalate privileges from user to admin by modifying their user type.
Original NVD description (English source)
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS