CVE Catalog
CVE-2026-36727
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.36%
29th percentile - higher than 29% of all known CVEs
Summary
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. An attacker can bypass authentication using a forged JWT token.
Risk Assessment
The risk is high – an attacker can gain unauthorized access to user accounts, potentially leading to data theft and account takeover.
Recommendation
Update the bookcars application to the latest patched version. Implement JWT token validation and restrict access to the endpoint to trusted sources only.
Original NVD description (English source)
An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.