CVE-2026-36727 describes an authentication bypass vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. The vulnerability arises from improper validation of JWT tokens, enabling attackers to forge tokens and gain unauthorized access. The vulnerability is publicly known but lacks a CVSS score and official remediation details. No exploits have been reported in the wild.

Successful exploitation allows an attacker to bypass authentication controls, potentially gaining unauthorized access to user accounts or protected functionality within the bookcars application. This compromises the integrity of the authentication mechanism and could lead to unauthorized actions or data exposure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint where possible and monitor for suspicious activity related to JWT token usage.