CVE-2026-5423 in graphql
Summary
by MITRE • 08/06/2026
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability in neo4j/graphql library versions prior to 7.5.6 represents a critical authentication bypass flaw that undermines the security of GraphQL subscription mechanisms. This issue stems from insufficient validation of client-supplied JWT objects within the connectionParams.jwt field during WebSocket connection establishment. The flaw allows unauthenticated attackers to manipulate authentication tokens by forging arbitrary claims such as subject identifiers and role assignments, effectively impersonating legitimate users or privileged accounts.
The technical implementation of this vulnerability resides in the library's failure to properly verify JWT authenticity when processing subscription connections. When clients establish GraphQL-over-WebSocket connections through the connectionParams parameter, the library accepts pre-decoded JWT objects without performing cryptographic verification of the token signature or validating the issuer claims. This creates a path where attackers can construct malicious JWT tokens containing false but valid-looking claims that bypass the normal authentication flow.
From an operational impact perspective, this vulnerability exposes organizations to significant security risks as unauthorized users can subscribe to sensitive data streams that should be restricted to authenticated personnel with specific roles. The attack vector is particularly dangerous because it requires minimal privileges to exploit - simply opening a GraphQL subscription connection allows an attacker to forge credentials and gain access to protected subscription events. This undermines the core security model of the authentication and subscriptionsAuthorization directives that are designed to enforce access controls based on user identity and permissions.
The vulnerability aligns with CWE-290 authentication bypass weakness and represents a direct violation of the principle of least privilege in access control systems. Attackers can leverage this flaw to perform unauthorized data exfiltration through subscription channels, potentially accessing sensitive information such as user data, business intelligence, or system metadata that should remain restricted to authorized personnel only. The impact extends beyond simple information disclosure to potentially enable further exploitation through lateral movement within the application's data access patterns.
Organizations should immediately upgrade their neo4j/graphql library installations to versions 7.5.6 or higher, or alternatively to 5.12.14 or newer, as these releases contain the necessary fixes to properly validate JWT authenticity. The v6 branch has reached end-of-life status and will not receive any security patches, making it imperative for users of this version to migrate to supported releases. Security teams should conduct immediate assessments of their GraphQL subscription implementations to identify potential exploitation vectors and implement additional monitoring for unauthorized subscription activities that might indicate successful exploitation attempts.