The flaw resides in the validateAccessToken routine of bookcars version 8.3, which neglects to perform cryptographic signature verification on JSON Web Tokens. As a result, an attacker can generate a forged token with arbitrary claims and submit it to the application, causing the server to accept it as genuine. This flaw enables an attacker to masquerade as any user, access protected resources, and potentially manipulate or exfiltrate confidential data managed by the application.

The product affected is bookcars v8.3. Vendor information is not supplied by the CNA; the vulnerability was disclosed in a component of the bookcars application, but no definitive vendor attribution is available.

The EPSS score of less than 1% suggests that active exploitation has not yet been widely observed, yet the CVSS score of 9.8 marks the vulnerability as critical. The absence of cryptographic validation gives an attacker a clear execution path: craft a JWT with desired claims, transmit it via a standard HTTP request to any endpoint that invokes validateAccessToken, and the request will be accepted as authenticated. Based on the description, it is inferred that the attack vector is the submission of a forged JWT over HTTP, as no additional privileges or system access are required. Although the vulnerability is not listed in the CISA KEV catalog and no publicly documented exploit exists, the simplicity of the required steps makes this a high‑risk issue for any deployment of bookcars v8.3.