CVE-2026-5423

HighCVSS 8.2

Published: 06/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

26th percentile - higher than 26% of all known CVEs

Summary

The @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client can forge arbitrary JWT claims (e.g., sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for @authentication and @subscriptionsAuthorization directive evaluation. This allows an unauthenticated attacker to receive subscription events restricted to specific authenticated roles/users. Upgrade to versions 7.5.6+ or 5.12.14+.

Risk Assessment

Risk of unauthorized access to subscription data that should be protected, potentially leading to confidentiality breaches.

Recommendation

Upgrade the @neo4j/graphql library to versions 7.5.6+ or 5.12.14+; v6 is end-of-life and will not receive a fix.

Other vulnerabilities in @neo4j/graphql

CVE-2026-19869High
@neo4j/graphql from version 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present. The field-level rule is silently discarded, allowing any client satisfying the coarser type-level requirement to invoke the more-restricted field.

Original NVD description (English source)

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.