CVE-2026-5423
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client can forge arbitrary JWT claims (e.g., sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for @authentication and @subscriptionsAuthorization directive evaluation. This allows an unauthenticated attacker to receive subscription events restricted to specific authenticated roles/users. Upgrade to versions 7.5.6+ or 5.12.14+.
Risk Assessment
Risk of unauthorized access to subscription data that should be protected, potentially leading to confidentiality breaches.
Recommendation
Upgrade the @neo4j/graphql library to versions 7.5.6+ or 5.12.14+; v6 is end-of-life and will not receive a fix.
Other vulnerabilities in @neo4j/graphql
See all- CVE-2026-92681Critical
In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on Query or Mutation types are silently ignored for top-level fields annotated with @cypher. Only @authentication directives placed directly on individual fields are enforced. An application exposing a top-level @cypher field and relying on schema-level or type-level @authentication allows unauthenticated callers to invoke the field and run the configured Cypher statement with the privileges of the GraphQL service account, potentially permitting reading and modifying data. Fixed in 7.6.4.
- CVE-2026-92682High
In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and connections is not negated when translated to Cypher, so it behaves like some. A rule such as "none of the related denied users matches the JWT subject" therefore returns exactly the records it was meant to exclude, and excludes those it was meant to return. An authenticated user whom such a rule is meant to deny can read the protected records. This is also the case for mutations, so the impact is that sensitive data could also be created and deleted by users that shouldn't have access according to the typedefs. Fixed in 7.6.4.
- CVE-2026-19869High
@neo4j/graphql from version 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present. The field-level rule is silently discarded, allowing any client satisfying the coarser type-level requirement to invoke the more-restricted field.
Original NVD description (English source)
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS