Do Son 
TL;DR
A high-severity authentication bypass affects the Neo4j GraphQL Library before versions 7.5.6 and 5.12.14. Tracked as CVE-2026-5423 (CVSS 8.2), it lets an unauthenticated attacker forge JWT claims over WebSocket subscriptions. Successful abuse exposes real-time data meant for authenticated users.
- CVE: CVE-2026-5423
- CVSS: 8.2 (High · CVSSv4)
- Product: neo4j graphql
- Affected: 7.0.0, 5.0.0, 6.0.0
- Impact: Subscription Authentication Bypass via Unverified connectionParams.jwt
- Status: No confirmed exploitation yet
- Patched in: 7.5.6, 5.12.14
- EPSS: 0.3% (30-day)
- Action: Update to 7.5.6, 5.12.14 now
Why This Neo4j GraphQL Flaw Matters
The @neo4j/graphql package is popular, with nearly 23,000 weekly downloads on npm. Many teams use it to build real-time APIs backed by connected data.
This authentication bypass turns a trusted feature into an open door. Because the attack needs no valid token, exposed endpoints leak sensitive subscription events to anyone on the network.
How the Attack Works
The flaw lives in the GraphQL subscriptions transport. According to the advisory, the library “fails to verify the authenticity of a client-supplied, pre-decoded JWT object” passed through subscription connectionParams.
As a result, an attacker opens a GraphQL-over-WebSocket connection and supplies a forged JWT object. The server accepts those claims, such as sub and roles, as a real identity. It then evaluates @authentication and @subscriptionsAuthorization rules against the fake values.
The vulnerability applies only when an app enables features.subscriptions and features.authorization, then forwards connectionParams into the resolver context. Confidentiality impact is high, but the bug does not allow writes or denial of service.
Affected Versions
The GitHub advisory lists these vulnerable ranges of the @neo4j/graphql npm package: 7.0.0 up to 7.5.6, and 5.0.0 up to 5.12.14. The entire v6 line is also affected and end-of-life.
No public proof-of-concept or in-the-wild exploitation has been confirmed at this time.
Patch and Mitigation
Upgrade to version 7.5.6 or 5.12.14 as soon as possible. Since v6 will not receive a fix, migrate off it entirely.
If you cannot patch immediately, restrict access to the GraphQL WebSocket endpoint. For full technical details, review the official Neo4j security advisory.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
