{"id":"CVE-2026-5423","summary":"Subscription Authentication Bypass via Unverified connectionParams.jwt","details":"@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users.\nUpgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.","aliases":["GHSA-fcpg-3fw5-vc65"],"modified":"2026-08-08T03:48:19.251876513Z","published":"2026-08-06T15:15:29.124Z","database_specific":{"cwe_ids":["CWE-302"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5423.json","cna_assigner":"Neo4j"},"references":[{"type":"WEB","url":"https://registry.npmjs.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5423.json"},{"type":"ADVISORY","url":"https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65"},{"type":"ADVISORY","url":"https://neo4j.com/security/CVE-2026-5423"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5423"},{"type":"PACKAGE","url":"https://github.com/neo4j/graphql"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/neo4j/graphql","events":[{"introduced":"16bb032f8a6ffa1d3348a228c6f2b89eeefdb4a5"},{"fixed":"57c53493949e67f3bf72c2b29370632d61aae95e"},{"introduced":"4777c9ca6bb31a6560ce465ca9ea81bfac121537"},{"fixed":"42c91ebed8d28b9391076979ea8ce3875b83cb82"},{"introduced":"2d8a04046d6735b5abd8510a68f1a90ef585675d"},{"last_affected":"02c5a802f5d2f689bf4751cd6109513479518bd4"}],"database_specific":{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"7.0.0"},{"fixed":"7.5.6"},{"introduced":"5.0.0"},{"fixed":"5.12.14"},{"introduced":"6.0.0"},{"last_affected":"6.6.4"}]}}],"versions":["@neo4j/graphql@5.12.12","@neo4j/graphql-ogm@5.12.12","@neo4j/graphql@5.12.11","@neo4j/graphql-ogm@5.12.11","@neo4j/graphql@7.5.4","@neo4j/graphql@7.5.3","@neo4j/graphql@7.5.2","@neo4j/graphql@7.5.1","@neo4j/graphql@7.5.0","@neo4j/graphql@7.4.4","@neo4j/graphql@7.4.3","@neo4j/graphql@7.4.2","@neo4j/graphql@7.4.1","@neo4j/graphql@7.4.0","@neo4j/graphql@7.3.3","@neo4j/graphql@7.3.2","@neo4j/graphql@7.3.1","@neo4j/introspector@5.0.1","@neo4j/graphql@6.6.4","@neo4j/graphql@7.3.0","@neo4j/graphql@7.2.13","@neo4j/graphql@7.2.12","@neo4j/graphql@5.12.10","@neo4j/graphql-ogm@5.12.10","@neo4j/graphql@5.12.9","@neo4j/graphql-ogm@5.12.9","@neo4j/graphql@7.2.11","@neo4j/graphql@7.2.10","@neo4j/graphql@7.2.9","@neo4j/graphql@7.2.8","@neo4j/graphql@7.2.7","@neo4j/graphql@7.2.6","@neo4j/graphql@5.12.8","@neo4j/graphql-ogm@5.12.8","@neo4j/graphql@7.2.5","@neo4j/graphql@6.6.3","@neo4j/graphql@7.2.4","@neo4j/graphql@7.2.3","@neo4j/graphql@5.12.7","@neo4j/graphql-ogm@5.12.7","@neo4j/graphql@7.2.2","@neo4j/graphql@7.2.1","@neo4j/graphql@7.2.0","@neo4j/graphql@5.12.6","@neo4j/graphql-ogm@5.12.6","@neo4j/graphql@5.12.5","@neo4j/graphql-ogm@5.12.5","@neo4j/graphql@7.1.3","@neo4j/graphql@6.6.2","@neo4j/graphql@7.1.2","@neo4j/graphql@5.12.4","@neo4j/graphql-ogm@5.12.4","@neo4j/graphql@5.12.3","@neo4j/graphql-ogm@5.12.3","@neo4j/graphql@5.12.2","@neo4j/graphql-ogm@5.12.2","@neo4j/graphql@7.1.1","@neo4j/graphql@7.1.0","@neo4j/introspector@5.0.0","@neo4j/graphql@7.0.0","@neo4j/graphql@6.6.1","@neo4j/graphql@6.6.0","@neo4j/graphql@5.12.1","@neo4j/graphql-ogm@5.12.1","@neo4j/graphql@6.5.3","@neo4j/graphql-amqp-subscriptions-engine@2.0.1","@neo4j/graphql@6.5.2","@neo4j/graphql@6.5.1","@neo4j/graphql@6.5.0","@neo4j/graphql@6.4.0","@neo4j/graphql@5.12.0","@neo4j/graphql-ogm@5.12.0","@neo4j/graphql@6.3.1","@neo4j/graphql@5.11.5","@neo4j/graphql-ogm@5.11.5","@neo4j/graphql@5.11.4","@neo4j/graphql-ogm@5.11.4","@neo4j/graphql@6.3.0","@neo4j/graphql@5.11.3","@neo4j/graphql-ogm@5.11.3","@neo4j/graphql@6.2.3","@neo4j/introspector@4.0.1","@neo4j/graphql@6.2.2","@neo4j/introspector@3.0.2","@neo4j/graphql@5.11.2","@neo4j/graphql-ogm@5.11.2","@neo4j/graphql@5.11.1","@neo4j/graphql-ogm@5.11.1","@neo4j/graphql@6.2.1","@neo4j/graphql@5.11.0","@neo4j/graphql-ogm@5.11.0","@neo4j/graphql@6.2.0","@neo4j/graphql@6.1.1","@neo4j/graphql@5.10.0","@neo4j/graphql-ogm@5.10.0","@neo4j/graphql@6.1.0","@neo4j/introspector@4.0.0","@neo4j/graphql@6.0.0","@neo4j/graphql@5.9.2","@neo4j/graphql-ogm@5.9.2","@neo4j/graphql@5.9.1","@neo4j/graphql-ogm@5.9.1","@neo4j/graphql@5.9.0","@neo4j/graphql-ogm@5.9.0","@neo4j/graphql@5.8.0","@neo4j/graphql-ogm@5.8.0","@neo4j/graphql@5.7.1","@neo4j/graphql-ogm@5.7.1","@neo4j/graphql@5.7.0","@neo4j/graphql-ogm@5.7.0","@neo4j/graphql@5.6.2","@neo4j/graphql-ogm@5.6.2","@neo4j/graphql@5.6.1","@neo4j/graphql-ogm@5.6.1","@neo4j/graphql@5.6.0","@neo4j/graphql-ogm@5.6.0","@neo4j/graphql@5.5.6","@neo4j/graphql-ogm@5.5.6","@neo4j/graphql@5.5.5","@neo4j/graphql-ogm@5.5.5","@neo4j/graphql@5.5.4","@neo4j/graphql-ogm@5.5.4","@neo4j/graphql@5.5.3","@neo4j/graphql-ogm@5.5.3","@neo4j/graphql@5.5.2","@neo4j/graphql-ogm@5.5.2","@neo4j/graphql@5.5.1","@neo4j/graphql-ogm@5.5.1","@neo4j/graphql@5.5.0","@neo4j/graphql-ogm@5.5.0","@neo4j/graphql@5.4.5","@neo4j/graphql-ogm@5.4.5","@neo4j/graphql@5.4.4","@neo4j/graphql-ogm@5.4.4","@neo4j/graphql@5.4.3","@neo4j/graphql-ogm@5.4.3","@neo4j/graphql@5.4.2","@neo4j/graphql-ogm@5.4.2","@neo4j/graphql@5.4.1","@neo4j/graphql-ogm@5.4.1","neo-place@0.1.5","@neo4j/graphql@5.4.0","@neo4j/graphql-ogm@5.4.0","@neo4j/graphql@5.3.6","@neo4j/graphql-ogm@5.3.6","@neo4j/graphql@5.3.5","@neo4j/graphql-ogm@5.3.5","@neo4j/introspector@3.0.1","@neo4j/graphql@5.3.4","@neo4j/graphql-ogm@5.3.4","@neo4j/graphql@5.3.3","@neo4j/graphql-ogm@5.3.3","@neo4j/graphql@5.3.2","@neo4j/graphql-ogm@5.3.2","@neo4j/graphql@5.3.1","@neo4j/graphql-ogm@5.3.1","@neo4j/graphql@5.3.0","@neo4j/graphql-ogm@5.3.0","@neo4j/graphql@5.2.0","@neo4j/graphql-toolbox@2.1.12","@neo4j/graphql-ogm@5.2.0","@neo4j/graphql@5.1.0","@neo4j/graphql-toolbox@2.1.11","@neo4j/graphql-ogm@5.1.0","@neo4j/graphql@5.0.1","@neo4j/graphql-toolbox@2.1.10","@neo4j/graphql-ogm@5.0.1","yoga-subscriptions-server@1.0.1","neo-place@0.1.4","apollo-subscriptions-server@1.0.2","@neo4j/introspector@3.0.0","@neo4j/graphql@5.0.0","@neo4j/graphql-toolbox@2.1.9","@neo4j/graphql-ogm@5.0.0","@neo4j/graphql-amqp-subscriptions-engine@2.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5423.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}]}