CVE-2026-36727 describes an authentication bypass vulnerability in the /api/social-sign-in endpoint of bookcars v8.3. The flaw allows attackers to bypass authentication by presenting a forged JSON Web Token (JWT), effectively granting unauthorized access. This vulnerability is categorized under CWE-287, indicating improper authentication mechanisms. The CVSS 3.1 base score is 9.1, reflecting a critical risk due to network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity. There is no vendor advisory or patch information available, and the affected versions are not explicitly detailed beyond the mention of v8.3.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls on the /api/social-sign-in endpoint, potentially gaining unauthorized access to user accounts or sensitive data. The impact includes complete compromise of confidentiality and integrity of the affected system's data accessible via this endpoint. Availability impact is not indicated. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider implementing additional controls such as enhanced monitoring of authentication endpoints, restricting access where possible, and validating JWT tokens with strict verification methods. Avoid relying solely on the vulnerable endpoint for authentication.