What is the CVSS score of CVE-2026-36721?

CVE-2026-36721 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of BookCars are affected by CVE-2026-36721?

BookCars v8.3 contains a critical authentication bypass (CVE-2026-36721) that allows unauthenticated remote attackers to forge JWT tokens and assume any user or administrator identity without…

How to fix or mitigate CVE-2026-36721?

Within 24 hours: immediately isolate BookCars v8.3 systems from production networks if deployed, disable external internet connectivity, and deploy Web Application Firewall rules to detect JWT token forgery attempts. Within 7 days: complete an inventory of all affected BookCars instances and environments, implement compensating controls including a reverse proxy authentication layer, network segmentation restricting access to trusted internal networks only, and comprehensive API logging; contact vendor for patch availability status. Within 30 days: establish a migration plan to either a patched BookCars version or alternative booking platform; if no patch is released within 30 days, execute rollover to an alternative vendor solution or return to manual booking processes, with target completion before day 60.

BookCars CVE-2026-36721

CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-09 mitre

Authentication Bypass Jwt Attack N A

9.8

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Forged JWT needs only network access to the API with no auth or user interaction (AV:N/AC:L/PR:N/UI:N), and full account/admin takeover yields complete C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:13 vuln.today

CVE Published

Jun 09, 2026 - 00:00 cve.org

CRITICAL 9.8

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

AnalysisAI

Authentication bypass in BookCars v8.3 lets remote attackers forge JWT tokens because the validateAccessToken function performs no cryptographic signature verification (CWE-347), allowing them to impersonate any user or administrator without credentials. The CVSS 9.8 rating reflects full compromise of confidentiality, integrity, and availability over the network. SSVC lists exploitation as POC with total technical impact and automatable=yes, though EPSS is very low (0.02%, 7th percentile) and it is not in CISA KEV; publicly available exploit code exists.

Technical ContextAI

BookCars is an open-source car rental platform (Node.js/React/MongoDB stack) that uses JSON Web Tokens (JWT) for session authentication. The vulnerability is a classic CWE-347 (Improper Verification of Cryptographic Signature): the validateAccessToken function decodes the JWT payload but fails to verify the token's HMAC/RSA signature against the server secret. Because the signature is the sole mechanism binding a token's claims to server-issued trust, skipping verification means the server accepts any attacker-crafted payload (e.g. an arbitrary user ID or admin role) as authentic. The supplied CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the vendor/product programmatically.

RemediationAI

No vendor-released patch version is identified at time of analysis; the only reference is a third-party vulnerability writeup (https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-2), so administrators should monitor the upstream BookCars repository for a fixed release and upgrade as soon as one is published. As a specific code-level fix, ensure validateAccessToken calls a verifying JWT API (e.g. jwt.verify with the server secret and an explicit algorithms allowlist) rather than a decode-only path, and reject tokens whose algorithm is 'none'. As compensating controls until patched: place the application behind an authenticating reverse proxy or WAF that enforces an independent session check, rotate the JWT signing secret and invalidate existing sessions, and restrict network exposure of the admin/API endpoints to trusted IPs - noting that IP restriction breaks legitimate remote/customer access and secret rotation forces all users to re-authenticate.