What is the CVSS score of CVE-2026-36727?

CVE-2026-36727 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of bookcars are affected by CVE-2026-36727?

bookcars v8.3 contains an authentication bypass enabling unauthenticated attackers to forge credentials and assume control of arbitrary user accounts.

How to fix or mitigate CVE-2026-36727?

24 hours: Inventory all bookcars v8.3 deployments across production, staging, and development; document data sensitivity and user population affected. 7 days: Implement network-layer access restrictions to the /api/social-sign-in endpoint, deploy WAF rules to detect abnormal JWT patterns, and enable audit logging for all token generation and use. 30 days: Monitor bookcars project for patched releases; prepare staging test plan and execute upgrade to the first available patched version once released.

bookcars CVE-2026-36727

CRITICAL

Improper Authentication (CWE-287)

2026-06-09 mitre

Authentication Bypass N A

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 19:22 vuln.today

CVSS changed

Jun 10, 2026 - 19:22 NVD

9.1 (CRITICAL)

CVE Published

Jun 09, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionNVD

An insecure authentication vulnerability in the /api/social-sign-in endpoint of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.

AnalysisAI

Authentication bypass in bookcars v8.3 lets remote unauthenticated attackers forge JWT tokens against the /api/social-sign-in endpoint to impersonate arbitrary users. The flaw carries a CVSS 9.1 rating with no public exploit identified at time of analysis, though a third-party vulnerability writeup is referenced on GitHub. EPSS is very low (0.02%, 7th percentile), suggesting limited mass-scanning interest despite the high severity.

Technical ContextAI

bookcars is an open-source car rental booking platform whose social sign-in flow accepts JWT tokens to authenticate users via federated identity providers. The vulnerability falls under CWE-287 (Improper Authentication): the /api/social-sign-in endpoint fails to properly validate the JWT signature, issuer, or audience, so a token crafted by the attacker (for example, signed with 'none' algorithm, a weak/known secret, or with mismatched claims) is accepted as legitimate. CPE data is unhelpful here (listed as n/a:n/a), so affected product identity must be derived from the description and the referenced GitHub writeup pointing at the bookcars project at version 8.3.

RemediationAI

No vendor-released patch identified at time of analysis; operators running bookcars v8.3 should monitor the upstream bookcars repository for a fixed release and consult the third-party writeup at https://github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vulnerability-1 for technical details. As compensating controls, restrict network access to the /api/social-sign-in endpoint via reverse-proxy ACLs or a WAF rule that requires the request to originate from expected IdP callback paths (trade-off: legitimate users on new networks may be blocked), disable the social sign-in feature entirely if not required and force password-based login instead (trade-off: degrades UX for users that signed up via federation), and rotate the JWT signing secret while enforcing server-side verification of token signature, issuer, audience, and algorithm allowlist (reject 'none' and asymmetric/symmetric confusion). Place the application behind an authenticating reverse proxy until a fix is released if it is exposed to untrusted networks.