CVE-2026-36727
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. An attacker can bypass authentication using a forged JWT token.
Risk Assessment
The risk is high – an attacker can gain unauthorized access to user accounts, potentially leading to data theft and account takeover.
Recommendation
Update the bookcars application to the latest patched version. Implement JWT token validation and restrict access to the endpoint to trusted sources only.
Other vulnerabilities in bookcars
See all- CVE-2026-36721Critical
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
- CVE-2026-36726Medium
The /api/delete-temp-license/{file} endpoint in bookcars v8.3 allows unauthenticated attackers to delete arbitrary files via directory traversal sequences.
- CVE-2026-36723High
An unrestricted file rename vulnerability in the /api/create-user component of bookcars v8.3. Authenticated attackers can move files from temporary storage to arbitrary locations, enabling access to sensitive files, overwriting critical files, and remote code execution.
- CVE-2026-36722Medium
An authenticated arbitrary file upload vulnerability in the /api/create-car-image component of bookcars v8.3 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2026-36720High
Insecure permissions in bookcars v8.3 allow authenticated attackers to escalate privileges from user to admin by modifying their user type.
Original NVD description (English source)
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS