CVE-2026-5423

Name of the Vulnerable Software and Affected Versions @neo4j/graphql versions prior to 7.5.6 @neo4j/graphql versions prior to 5.12.14

Description The library fails to verify the authenticity of a pre-decoded JSON Web Token (JWT) object provided by a client through GraphQL subscription connectionParams. An unauthenticated remote client establishing a GraphQL-over-WebSocket connection can forge arbitrary JWT claims, such as sub and roles, within connectionParams.jwt. These forged claims are accepted as a valid authenticated identity during the evaluation of @authentication and @subscriptionsAuthorization directives, allowing an attacker to receive subscription events intended for restricted roles or users.

Recommendations Update to version 7.5.6 or later. Update to version 5.12.14 or later.