CVE-2026-36727: An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8

Synopsis

Authentication bypass in bookcars v8.3 allows a remote, unauthenticated attacker to forge a JWT token and gain unauthorized access through the /api/social-sign-in endpoint. The vulnerability is reachable over the network and requires no credentials or user interaction to exploit. Successful exploitation gives the attacker full read and write access to data accessible under the compromised identity. No fix version has been published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the bookcars API service via HTTP/HTTPS to deliver a forged JWT token.

• AuthenticationNot required

  No credentials are needed; the vulnerability exists precisely in the authentication mechanism itself, allowing a completely unauthenticated attacker to forge a valid-looking JWT.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access to the endpoint.

Blast Radius

• An attacker who forges a JWT token gains full read access to data accessible under the spoofed identity, which may include personal information, booking records, and stored credentials.
• Write access under the compromised identity allows the attacker to create, modify, or delete bookings and account data within the application.
• If the forged token can impersonate an administrative account, the attacker gains control over all user records and application configuration exposed via the API.