CVE-2026-5423

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-5423
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5423.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-5423
Aliases
  • GHSA-fcpg-3fw5-vc65
Published
2026-08-06T15:15:29.124Z
Modified
2026-08-08T03:48:19.251876513Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Subscription Authentication Bypass via Unverified connectionParams.jwt
Details

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.

Database specific 
{
    "cwe_ids": [
        "CWE-302"
    ],
    "cna_assigner": "Neo4j",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5423.json"
}
References

Affected packages

Git / github.com/neo4j/graphql

Affected ranges

Type
GIT
Repo
https://github.com/neo4j/graphql
Events
Introduced
16bb032f8a6ffa1d3348a228c6f2b89eeefdb4a5
Fixed
57c53493949e67f3bf72c2b29370632d61aae95e
Introduced
4777c9ca6bb31a6560ce465ca9ea81bfac121537
Fixed
42c91ebed8d28b9391076979ea8ce3875b83cb82
Introduced
2d8a04046d6735b5abd8510a68f1a90ef585675d
Last affected
02c5a802f5d2f689bf4751cd6109513479518bd4
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "7.0.0"
        },
        {
            "fixed": "7.5.6"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.12.14"
        },
        {
            "introduced": "6.0.0"
        },
        {
            "last_affected": "6.6.4"
        }
    ]
}

Affected versions

@neo4j/graphql-amqp-subscriptions-engine@2.*
@neo4j/graphql-amqp-subscriptions-engine@2.0.0
@neo4j/graphql-amqp-subscriptions-engine@2.0.1
@neo4j/graphql-ogm@5.*
@neo4j/graphql-ogm@5.0.0
@neo4j/graphql-ogm@5.0.1
@neo4j/graphql-ogm@5.1.0
@neo4j/graphql-ogm@5.10.0
@neo4j/graphql-ogm@5.11.0
@neo4j/graphql-ogm@5.11.1
@neo4j/graphql-ogm@5.11.2
@neo4j/graphql-ogm@5.11.3
@neo4j/graphql-ogm@5.11.4
@neo4j/graphql-ogm@5.11.5
@neo4j/graphql-ogm@5.12.0
@neo4j/graphql-ogm@5.12.1
@neo4j/graphql-ogm@5.12.10
@neo4j/graphql-ogm@5.12.11
@neo4j/graphql-ogm@5.12.12
@neo4j/graphql-ogm@5.12.2
@neo4j/graphql-ogm@5.12.3
@neo4j/graphql-ogm@5.12.4
@neo4j/graphql-ogm@5.12.5
@neo4j/graphql-ogm@5.12.6
@neo4j/graphql-ogm@5.12.7
@neo4j/graphql-ogm@5.12.8
@neo4j/graphql-ogm@5.12.9
@neo4j/graphql-ogm@5.2.0
@neo4j/graphql-ogm@5.3.0
@neo4j/graphql-ogm@5.3.1
@neo4j/graphql-ogm@5.3.2
@neo4j/graphql-ogm@5.3.3
@neo4j/graphql-ogm@5.3.4
@neo4j/graphql-ogm@5.3.5
@neo4j/graphql-ogm@5.3.6
@neo4j/graphql-ogm@5.4.0
@neo4j/graphql-ogm@5.4.1
@neo4j/graphql-ogm@5.4.2
@neo4j/graphql-ogm@5.4.3
@neo4j/graphql-ogm@5.4.4
@neo4j/graphql-ogm@5.4.5
@neo4j/graphql-ogm@5.5.0
@neo4j/graphql-ogm@5.5.1
@neo4j/graphql-ogm@5.5.2
@neo4j/graphql-ogm@5.5.3
@neo4j/graphql-ogm@5.5.4
@neo4j/graphql-ogm@5.5.5
@neo4j/graphql-ogm@5.5.6
@neo4j/graphql-ogm@5.6.0
@neo4j/graphql-ogm@5.6.1
@neo4j/graphql-ogm@5.6.2
@neo4j/graphql-ogm@5.7.0
@neo4j/graphql-ogm@5.7.1
@neo4j/graphql-ogm@5.8.0
@neo4j/graphql-ogm@5.9.0
@neo4j/graphql-ogm@5.9.1
@neo4j/graphql-ogm@5.9.2
@neo4j/graphql-toolbox@2.*
@neo4j/graphql-toolbox@2.1.10
@neo4j/graphql-toolbox@2.1.11
@neo4j/graphql-toolbox@2.1.12
@neo4j/graphql-toolbox@2.1.9
@neo4j/graphql@5.*
@neo4j/graphql@5.0.0
@neo4j/graphql@5.0.1
@neo4j/graphql@5.1.0
@neo4j/graphql@5.10.0
@neo4j/graphql@5.11.0
@neo4j/graphql@5.11.1
@neo4j/graphql@5.11.2
@neo4j/graphql@5.11.3
@neo4j/graphql@5.11.4
@neo4j/graphql@5.11.5
@neo4j/graphql@5.12.0
@neo4j/graphql@5.12.1
@neo4j/graphql@5.12.10
@neo4j/graphql@5.12.11
@neo4j/graphql@5.12.12
@neo4j/graphql@5.12.2
@neo4j/graphql@5.12.3
@neo4j/graphql@5.12.4
@neo4j/graphql@5.12.5
@neo4j/graphql@5.12.6
@neo4j/graphql@5.12.7
@neo4j/graphql@5.12.8
@neo4j/graphql@5.12.9
@neo4j/graphql@5.2.0
@neo4j/graphql@5.3.0
@neo4j/graphql@5.3.1
@neo4j/graphql@5.3.2
@neo4j/graphql@5.3.3
@neo4j/graphql@5.3.4
@neo4j/graphql@5.3.5
@neo4j/graphql@5.3.6
@neo4j/graphql@5.4.0
@neo4j/graphql@5.4.1
@neo4j/graphql@5.4.2
@neo4j/graphql@5.4.3
@neo4j/graphql@5.4.4
@neo4j/graphql@5.4.5
@neo4j/graphql@5.5.0
@neo4j/graphql@5.5.1
@neo4j/graphql@5.5.2
@neo4j/graphql@5.5.3
@neo4j/graphql@5.5.4
@neo4j/graphql@5.5.5
@neo4j/graphql@5.5.6
@neo4j/graphql@5.6.0
@neo4j/graphql@5.6.1
@neo4j/graphql@5.6.2
@neo4j/graphql@5.7.0
@neo4j/graphql@5.7.1
@neo4j/graphql@5.8.0
@neo4j/graphql@5.9.0
@neo4j/graphql@5.9.1
@neo4j/graphql@5.9.2
@neo4j/graphql@6.*
@neo4j/graphql@6.0.0
@neo4j/graphql@6.1.0
@neo4j/graphql@6.1.1
@neo4j/graphql@6.2.0
@neo4j/graphql@6.2.1
@neo4j/graphql@6.2.2
@neo4j/graphql@6.2.3
@neo4j/graphql@6.3.0
@neo4j/graphql@6.3.1
@neo4j/graphql@6.4.0
@neo4j/graphql@6.5.0
@neo4j/graphql@6.5.1
@neo4j/graphql@6.5.2
@neo4j/graphql@6.5.3
@neo4j/graphql@6.6.0
@neo4j/graphql@6.6.1
@neo4j/graphql@6.6.2
@neo4j/graphql@6.6.3
@neo4j/graphql@6.6.4
@neo4j/graphql@7.*
@neo4j/graphql@7.0.0
@neo4j/graphql@7.1.0
@neo4j/graphql@7.1.1
@neo4j/graphql@7.1.2
@neo4j/graphql@7.1.3
@neo4j/graphql@7.2.0
@neo4j/graphql@7.2.1
@neo4j/graphql@7.2.10
@neo4j/graphql@7.2.11
@neo4j/graphql@7.2.12
@neo4j/graphql@7.2.13
@neo4j/graphql@7.2.2
@neo4j/graphql@7.2.3
@neo4j/graphql@7.2.4
@neo4j/graphql@7.2.5
@neo4j/graphql@7.2.6
@neo4j/graphql@7.2.7
@neo4j/graphql@7.2.8
@neo4j/graphql@7.2.9
@neo4j/graphql@7.3.0
@neo4j/graphql@7.3.1
@neo4j/graphql@7.3.2
@neo4j/graphql@7.3.3
@neo4j/graphql@7.4.0
@neo4j/graphql@7.4.1
@neo4j/graphql@7.4.2
@neo4j/graphql@7.4.3
@neo4j/graphql@7.4.4
@neo4j/graphql@7.5.0
@neo4j/graphql@7.5.1
@neo4j/graphql@7.5.2
@neo4j/graphql@7.5.3
@neo4j/graphql@7.5.4
@neo4j/introspector@3.*
@neo4j/introspector@3.0.0
@neo4j/introspector@3.0.1
@neo4j/introspector@3.0.2
@neo4j/introspector@4.*
@neo4j/introspector@4.0.0
@neo4j/introspector@4.0.1
@neo4j/introspector@5.*
@neo4j/introspector@5.0.0
@neo4j/introspector@5.0.1
apollo-subscriptions-server@1.*
apollo-subscriptions-server@1.0.2
neo-place@0.*
neo-place@0.1.4
neo-place@0.1.5
yoga-subscriptions-server@1.*
yoga-subscriptions-server@1.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-5423.json"