BookCars CVE-2026-36721

The only prerequisite is network reachability to a BookCars v8.3 instance's token-validated endpoints and knowledge of the JWT payload structure (which the open-source code exposes). No credentials, no user interaction, and no special server configuration are required - the flaw is in the default validateAccessToken code path. Exploitation is limited only by whether the target actually runs BookCars v8.3 and whether its API is network-accessible to the attacker; there is no authentication, complexity, or platform barrier reducing feasibility.

Signals are partially conflicting and should be weighed rather than taken at face value. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) and SSVC (exploitation=poc, automatable=yes, technical impact=total) both point to a trivially exploitable, high-impact flaw - a forged token requires no authentication and no user interaction. However, EPSS is only 0.02% (7th percentile) and the CVE is NOT in CISA KEV, indicating no evidence of widespread active exploitation, consistent with BookCars being a niche open-source product rather than a mass-deployed enterprise target. The net picture: technically severe and easy to exploit against any exposed instance, but real-world attack surface is small. Priority is high for any organization actually running BookCars and low for everyone else.

An attacker crafts a JWT with a payload asserting an administrator user ID and an arbitrary or 'none' signature, then submits it to a protected BookCars API endpoint. Because validateAccessToken never checks the signature, the server accepts the forged token and grants full administrative access with no credentials. Publicly available exploit material exists per the referenced writeup, and the attack is fully remote and automatable.