External risk intelligence

bookcars v8.3 Social Sign-In Authentication Bypass via Forged JWT Token

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-36727

The vulnerability resides in a social sign-in API endpoint (/api/social-sign-in). Such endpoints are typically designed to be exposed to the public internet to facilitate external authentication services for users, making the vulnerable component commonly internet-facing.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the authentication mechanism of a specific application, enabling unauthorized access through forged security tokens. This issue could potentially allow malicious actors to bypass security controls and gain access to the system. The main concern is to confirm if this technology is in use within our environment and to what extent it may be exposed.

Unauthenticated access bypass via token forgery.
Critical issue impacts authentication security.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could target the social sign-in API endpoint, which is exposed externally, to bypass authentication by submitting a specially crafted JSON Web Token (JWT). Successful bypass could grant unauthorized access to the application, potentially leading to sensitive data exposure or unauthorized modifications.

Requires network access.
Forged JWT to bypass authentication.
Unauthorized access and data compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthorized access to the system by bypassing authentication mechanisms on the social sign-in endpoint. When successfully exploited, this could lead to the exposure of system data and potentially impact service behavior, as an attacker could gain access without proper credentials.

System data could be exposed.
Authentication could be bypassed via forged token.
Unauthorized access to system data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical authentication bypass vulnerability in the social sign-in API requires immediate attention, likely falling under the purview of platform or application teams responsible for the bookcars system. The first practical step is to identify all instances of bookcars, determine their external reachability and business criticality, and assign ownership for remediation planning.

Platform or application teams own this.
Verify external reachability and business impact.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is bookcars?

bookcars is a software application designed for rental management, providing features that typically include vehicle booking, fleet management, and customer reservation tracking. Version 8.3 includes a social sign-in feature that enables users to authenticate via external identity providers.

What is the vulnerability in CVE-2026-36727?

The issue is an insecure authentication weakness, specifically classified as Improper Authentication (CWE-287). In this case, the system fails to properly verify the integrity or origin of JSON Web Tokens (JWTs) submitted to the social sign-in endpoint, allowing an attacker to bypass the login process entirely by presenting a forged token.

How does an attacker trigger this authentication bypass?

An attacker triggers this by sending a specially crafted, forged JWT to the /api/social-sign-in endpoint. The bug exists specifically in how this endpoint processes tokens; authentication attempts that do not involve the social sign-in API or that use legitimate, server-issued tokens are not affected by this particular vulnerability.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal identifies this vulnerability as likely internet-facing. Because the affected /api/social-sign-in endpoint is designed to handle external authentication requests, it is commonly accessible from the public internet, increasing the potential for unauthorized access from outside your network.

What should I do if I run bookcars v8.3?

The priority is to locate all instances of bookcars v8.3 within your environment. Once identified, evaluate whether these instances are reachable from the internet, assess their business criticality, and coordinate with your platform or application teams to prepare for remediation.

References

github.com/CC-T-454455/Vulnerabilities/tree/master/bookcars/vuln…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.