The vulnerability is an insecure authentication flaw in the /api/social-sign-in endpoint of bookcars version 8.3. Attackers can create a forged JSON Web Token that the server does not correctly validate. If the forged token is accepted, the attacker can impersonate any user, gaining full access rights granted to that user.

BookCars web application version 8.3, specifically the /api/social-sign-in API endpoint. No other products or versions are currently documented as affected.

The exploit requires only the ability to issue HTTP requests to the API; no special user privileges are needed. With the current lack of proper JWT verification, attackers can bypass authentication entirely, potentially compromising all data stored by the application. No CVSS score is published, and the EPSS score is not available, but the functionality suggests a high severity. The vulnerability is not listed in CISA KEV. Remote exploitation is straightforward via crafted HTTP requests.