CVE-2026-36721: A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8

Synopsis

Authentication bypass in bookcars v8.3 allows an unauthenticated attacker to forge a JWT token and gain access without valid credentials. The vulnerability is reachable over the network and requires no authentication or user interaction to exploit. Successful exploitation gives the attacker full read, write, and availability impact against the affected service. HarborGuard is tracking the advisory for upstream patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable validateAccessToken function is exposed over the network, so an attacker must be able to reach the service via a standard network connection.

• AuthenticationNot required

  The flaw exists precisely in the authentication layer, so no valid credentials or account are needed before sending a forged JWT token.

• Victim interactionNot required

  No user action is required; the attacker targets the service endpoint directly without involving any other party.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special environmental conditions, race timing, or memory-layout knowledge.

Blast Radius

• Attacker reads all data accessible to authenticated users, including stored session tokens, user records, and any booking or payment data held by the application.
• Attacker writes or modifies persisted application data, including user accounts, reservations, and configuration records.
• Attacker can disrupt service availability by issuing destructive authenticated requests, crashing or corrupting application state.
• Full authentication bypass means the attacker inherits the broadest permission set the application grants, with no per-user scope restriction.