CVE-2026-36721: Bookcars Authentication Bypass Vulnerability

CVE-2026-36721 Overview

CVE-2026-36721 is an authentication bypass vulnerability in the validateAccessToken function of bookcars v8.3. The function fails to perform cryptographic signature verification on JSON Web Tokens (JWT). Attackers can forge JWT tokens and bypass authentication entirely. The flaw is categorized under [CWE-347] Improper Verification of Cryptographic Signature.

The vulnerability is network-exploitable, requires no privileges, and no user interaction. Successful exploitation grants attackers full access to protected functionality and user data within the bookcars application.

Critical Impact
Unauthenticated remote attackers can forge JWT tokens to impersonate any user, including administrators, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

bookcars v8.3
Earlier versions of bookcars using the same validateAccessToken implementation may also be affected
Deployments exposing the bookcars API endpoint to untrusted networks

Discovery Timeline

2026-06-09 - CVE-2026-36721 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36721

Vulnerability Analysis

The validateAccessToken function in bookcars v8.3 decodes JWT payloads without verifying the token's cryptographic signature. JWTs consist of three Base64URL-encoded segments: header, payload, and signature. A secure implementation must validate the signature against a trusted secret or public key before trusting any payload claims.

In the vulnerable implementation, the function extracts identity and role claims directly from the decoded payload. It does not reject tokens with invalid signatures, tokens signed with unauthorized algorithms, or tokens using the none algorithm. This allows any attacker to construct a token with arbitrary claims and gain authenticated access.

The vulnerability falls under [CWE-347] Improper Verification of Cryptographic Signature. Technical details are documented in the GitHub Vulnerability Repository.

Root Cause

The root cause is the absence of a signature verification step in validateAccessToken. The function likely calls a JWT decoding routine rather than a verification routine, or passes options that disable signature checks. Trust is placed in client-supplied data without any cryptographic guarantee of origin.

Attack Vector

An attacker crafts a JWT with a chosen userId, role, or equivalent identity claim. The attacker supplies an empty, random, or none-algorithm signature. The forged token is submitted in the Authorization header to any protected bookcars API endpoint. The server accepts the token and processes the request under the impersonated identity.

No authentication, credentials, or user interaction are required. The attack is fully remote and scriptable. See the proof-of-concept repository for exploitation specifics.

Detection Methods for CVE-2026-36721

Indicators of Compromise

JWT tokens in HTTP requests with alg: none in the header or empty signature segments
Authentication events for privileged accounts originating from unexpected IP addresses or user agents
API requests where the userId claim does not correlate with any prior valid login session
Sudden privilege changes or administrative actions not tied to an interactive login

Detection Strategies

Inspect inbound JWTs at a reverse proxy or WAF and reject tokens with alg: none or malformed signatures
Correlate JWT-authenticated requests against issuance records to detect tokens that were never issued by the server
Alert on access tokens carrying privileged roles that lack a corresponding successful login event
Hunt for repeated requests with rotating userId claims from a single source, indicating enumeration

Monitoring Recommendations

Enable verbose logging on the bookcars authentication middleware and forward logs to a centralized SIEM
Track HTTP 200 responses to authenticated endpoints that were not preceded by a /login or token-issuance event
Monitor for anomalous administrative API calls and changes to user records
Review reverse proxy logs for malformed Authorization: Bearer headers

How to Mitigate CVE-2026-36721

Immediate Actions Required

Restrict network exposure of the bookcars API until a fixed version is deployed
Rotate any JWT signing secrets to invalidate previously issued or potentially forged tokens
Audit user, booking, and administrative records for unauthorized modifications since the application was deployed
Deploy a reverse proxy or WAF rule that rejects JWTs lacking a valid HMAC or RSA signature

Patch Information

No official vendor patch is referenced in the NVD entry at publication. Maintainers should update validateAccessToken to invoke a verifying JWT library function such as jwt.verify(token, secret, { algorithms: ['HS256'] }) rather than jwt.decode(token). Track upstream fixes through the project's vulnerability disclosure.

Workarounds

Place an authenticating reverse proxy in front of bookcars that validates JWT signatures before requests reach the application
Disable or block the none algorithm at the gateway layer and enforce an allowlist of approved signing algorithms
Apply short token lifetimes and require re-authentication for sensitive operations to reduce exposure
Restrict access to the bookcars API to known IP ranges or VPN-connected users where feasible

bash

# Example NGINX snippet to reject JWTs using the 'none' algorithm
# Requires the njs module for JWT inspection
location /api/ {
    auth_jwt "bookcars";
    auth_jwt_key_file /etc/nginx/jwt-secret.jwk;
    auth_jwt_algorithm HS256;
    proxy_pass http://bookcars_backend;
}