CVE-2026-36727 - An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token

Back Back to CVE browser

CRITICAL

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token

Published Jun 9, 2026

9.1

CRITICAL

CVSS 3.1

EPSS 0.53%

Description

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35929		Advisory
https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-1		exploit

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jun 9, 2026

Updated Jun 10, 2026

Reserved Apr 6, 2026

Link CVE-2026-36727

CISA Vulnrichment

Updated Jun 10, 2026

NVD

Status Deferred

Modified Jul 23, 2026

Link CVE-2026-36727

Red Hat

No data

ENISA EUVD

Assigner mitre

Published Jun 9, 2026

Updated Jun 10, 2026

Link EUVD-2026-35929

GitHub

No data