PT-2026-68621 · Neo4J · @Neo4J/Graphql
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
@neo4j/graphql versions prior to 7.5.6
@neo4j/graphql versions prior to 5.12.14
Description
The library fails to verify the authenticity of a pre-decoded JSON Web Token (JWT) object provided by a client through GraphQL subscription
connectionParams. An unauthenticated remote client establishing a GraphQL-over-WebSocket connection can forge arbitrary JWT claims, such as sub and roles, within connectionParams.jwt. These forged claims are accepted as a valid authenticated identity during the evaluation of @authentication and @subscriptionsAuthorization directives, allowing an attacker to receive subscription events intended for restricted roles or users.Recommendations
Update to version 7.5.6 or later.
Update to version 5.12.14 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Neo4J/Graphql