CVE-2026-36721 describes a vulnerability in bookcars version 8.3 where the validateAccessToken function does not perform cryptographic signature verification on JSON Web Tokens (JWT). This omission enables attackers to craft forged JWT tokens that bypass authentication controls, potentially granting unauthorized access to the system. The vulnerability is classified under CWE-347 (Improper Verification of Cryptographic Signature). No patch or official remediation guidance has been provided as of the published date.

Successful exploitation of this vulnerability allows an unauthenticated attacker to bypass authentication mechanisms, leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in unauthorized access to sensitive data and system functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider implementing additional access controls or monitoring to detect unauthorized access attempts involving JWT tokens. Avoid relying solely on the vulnerable validateAccessToken function for authentication.