CVE-2026-5423 Details
Description
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.
A vulnerability exists in the @neo4j/graphql library in versions prior to 7.5.6, as well as in versions 5.0.0 prior to 5.12.14 and in version 6, which is end-of-life. The issue arises because the library fails to verify the authenticity of client-supplied, pre-decoded JWT objects in GraphQL subscription connection parameters. This flaw allows unauthenticated remote clients to forge JWT claims, such as 'sub' and 'roles', and have them accepted as authenticated identities. Consequently, attackers can bypass authentication and authorization directives, gaining access to subscription events meant for specific roles or users.
Users are advised to upgrade the @neo4j/graphql library to version 7.5.6 or later, or to version 5.12.14. Version 6 is no longer supported and will not receive a fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65 | Neo4j | |
| https://neo4j.com/security/CVE-2026-5423 | Neo4j |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | Neo4j |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 6, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2026 | New CVE Received | Neo4j |