Executive brief
BookCars, a car rental management system, contains a security flaw in how it handles social media logins (such as Facebook or Apple). An attacker can bypass the login process by creating a fake digital identity token, allowing them to gain full access to any user's account. This could lead to the theft of customer personal information, unauthorized bookings, and complete control over administrative or user accounts.
Technical details
An authentication bypass vulnerability exists in the `/api/social-sign-in` endpoint of BookCars (up to and including v8.3). The application fails to properly validate the signature of JSON Web Tokens (JWT) provided during social sign-in flows (e.g., Facebook, Apple). Instead of verifying the token against the provider's public keys, the system accepts base64-encoded JSON payloads without cryptographic verification. A remote, unauthenticated attacker can exploit this by crafting a forged JWT to impersonate any user, leading to full account takeover. Affected files include `userRoutes.ts`, `userController.ts`, and `authHelper.ts`.
Affected products
- BookCars BookCars <= v8.3
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory