Executive brief
Bookcars is a car rental management system. A security flaw in its authentication process allows unauthorized individuals to bypass login requirements by using forged digital identity tokens. This could lead to unauthorized access to the system, potentially exposing customer data or allowing malicious changes to rental bookings.
Technical details
The vulnerability exists within the 'validateAccessToken' function of bookcars v8.3 due to a failure to verify the cryptographic signatures of JSON Web Tokens (JWT). Because the application trusts the contents of the token without validating its integrity against a secret key, a remote, unauthenticated attacker can craft a malicious JWT with arbitrary claims (such as administrative user IDs). By presenting this forged token in the authentication header, the attacker can successfully bypass authentication mechanisms and gain unauthorized access to protected API endpoints and user sessions.
Affected products
- bookcars bookcars 8.3
Timeline
- 2026-06-09: disclosed: Initial disclosure and NVD publication