The application enables `features.subscriptions` and `features.authorization`, and wires the subscriptions transport (e.g. `graphql-ws`) to forward WebSocket `connectionParams` into the resolver context.
"}],"value":"The application enables `features.subscriptions` and `features.authorization`, and wires the subscriptions transport (e.g. `graphql-ws`) to forward WebSocket `connectionParams` into the resolver context."}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*","versionEndExcluding":"7.5.6","versionStartIncluding":"7.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*","versionEndExcluding":"5.12.14","versionStartIncluding":"5.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:neo4j:graphql:*:*:*:*:*:*:*:*","versionEndIncluding":"6.6.4","versionStartIncluding":"6.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"EQSTLab (https://github.com/EQSTLab)"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users.Fixed in 5.12.14 (LTS) and 7.5.6 (current). The 6.x line is end-of-life and will not receive a patch; users on 6.x must upgrade to 5.12.14+ or 7.5.6+.
"}],"value":"Fixed in 5.12.14 (LTS) and 7.5.6 (current). The 6.x line is end-of-life and will not receive a patch; users on 6.x must upgrade to 5.12.14+ or 7.5.6+."}],"source":{"discovery":"EXTERNAL"},"title":"Subscription Authentication Bypass via Unverified connectionParams.jwt","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","assignerShortName":"Neo4j","cveId":"CVE-2026-5423","datePublished":"2026-08-06T15:15:29.124Z","dateReserved":"2026-04-02T13:17:29.975Z","dateUpdated":"2026-08-06T15:45:22.183Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-06 16:16:44","lastModifiedDate":"2026-08-18 15:04:46","problem_types":["CWE-302","CWE-302 CWE-302 Authentication bypass by Assumed-Immutable data"],"metrics":{"cvssMetricV40":[{"source":"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-06T15:45:16.532890Z","id":"CVE-2026-5423","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"5423","Ordinal":"1","Title":"Subscription Authentication Bypass via Unverified connectionPara","CVE":"CVE-2026-5423","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"5423","Ordinal":"1","NoteData":"@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users.\nUpgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.","Type":"Description","Title":"Subscription Authentication Bypass via Unverified connectionPara"}]}}}