CVE-2026-36727 Details

A vulnerability exists in BookCars versions through 8.3 at the '/api/social-sign-in' endpoint, where the application improperly validates JWT access tokens from social sign-in providers. This flaw allows unauthenticated attackers to forge JWT tokens and authenticate as any user, enabling complete account takeover via social sign-in flows such as Facebook and Apple. The vulnerability arises because the application fails to verify the cryptographic signature of the JWT tokens, making it easy to create valid-looking tokens by simply base64-encoding a JSON payload.

Implement proper JWT signature verification using the public keys of the respective social sign-in providers. Validate tokens against the providers' official token validation endpoints, check token expiration, and add rate limiting to the authentication endpoint to prevent brute force attacks.