CVE-2026-36727: Bookcars Authentication Bypass Vulnerability

CVE-2026-36727 Overview

CVE-2026-36727 is an authentication bypass vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. Attackers can forge a JSON Web Token (JWT) and bypass authentication controls without valid credentials. The flaw maps to [CWE-287] Improper Authentication and is network-exploitable without user interaction.

A successful attack grants unauthorized access to user accounts and protected functionality of the bookcars application. The vulnerability does not require prior privileges, making it accessible to any remote attacker who can reach the API endpoint.

Critical Impact
Remote attackers can forge JWT tokens to authenticate as arbitrary users through the /api/social-sign-in endpoint, leading to full account takeover and unauthorized access to protected resources.

Affected Products

bookcars v8.3
Deployments exposing the /api/social-sign-in endpoint
Applications that trust JWTs processed by the affected social sign-in handler

Discovery Timeline

2026-06-09 - CVE-2026-36727 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-36727

Vulnerability Analysis

The vulnerability resides in the social sign-in flow exposed at /api/social-sign-in. The endpoint accepts a JWT and validates it improperly, allowing an attacker to submit a forged token and obtain an authenticated session. Because the endpoint is reachable over the network and requires no prior authentication, exploitation can be performed by any remote attacker who can send HTTP requests to the application.

The weakness is categorized as [CWE-287] Improper Authentication. The impact extends to confidentiality and integrity of user data, as a forged token can be used to impersonate registered users and execute actions on their behalf. Availability of the application itself is not directly impacted by the flaw.

Root Cause

The /api/social-sign-in endpoint does not correctly verify the cryptographic signature, issuer, or audience claims of the submitted JWT. Common root causes for this class of bug include accepting the alg: none header, using a weak or hardcoded signing secret, or trusting client-supplied claims without verification. The result is that an attacker-crafted token is treated as authentic by the server.

Attack Vector

An attacker constructs a JWT containing the identity claims of a target user. The token is submitted to /api/social-sign-in over HTTP, and the server returns an authenticated session or access token. The attacker then uses that session to interact with protected APIs as the impersonated user. Technical details and a proof of concept are published in the GitHub PoC Repository.

Detection Methods for CVE-2026-36727

Indicators of Compromise

Requests to /api/social-sign-in containing JWTs with alg: none, unusual issuers, or mismatched signing keys.
Successful authentication events for users who did not initiate a social sign-in flow on the client side.
Session creation from IP addresses or user agents that do not match the legitimate user's typical activity.

Detection Strategies

Log and inspect every JWT processed by /api/social-sign-in, decoding the header and payload to flag tokens with weak or missing signatures.
Correlate sign-in events with upstream OAuth provider callbacks to identify sessions created without a corresponding provider interaction.
Alert on bursts of social sign-in requests from a single source targeting multiple user identifiers.

Monitoring Recommendations

Forward application and reverse proxy logs to a centralized analytics platform and retain JWT metadata for forensic review.
Monitor authentication success rates and account access patterns for anomalies following the publication date.
Track changes to JWT signing keys and rotate them if exposure is suspected.

How to Mitigate CVE-2026-36727

Immediate Actions Required

Restrict or disable the /api/social-sign-in endpoint at the gateway or WAF until a fixed version of bookcars is deployed.
Rotate JWT signing secrets and invalidate active sessions to revoke any tokens that may have been forged.
Audit recent authentication logs for evidence of forged-token use and lock impacted accounts pending review.

Patch Information

No vendor patch is referenced in the published CVE record at the time of writing. Operators of bookcars v8.3 should monitor the project repository and security advisories for an official fix and upgrade as soon as a patched release is available.

Workarounds

Enforce strict JWT validation in a reverse proxy: reject tokens with alg: none, validate the signature against the expected key, and verify iss, aud, and exp claims.
Require an additional server-side check that the social provider has confirmed the identity through a backchannel call, rather than trusting the client-supplied token alone.
Apply rate limiting and IP reputation controls to /api/social-sign-in to slow automated exploitation attempts.

bash

# Configuration example
# Example NGINX snippet to block JWTs with alg:none before they reach bookcars
location /api/social-sign-in {
    if ($http_authorization ~* "eyJhbGciOiJub25lIg") { return 401; }
    proxy_pass http://bookcars_upstream;
}