Vulnerability in Neo4j Graphql
CVE-2026-5423
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open…
Affected products
- Neo4j Graphql — versions 7.0.0, 5.0.0, 6.0.0
Weakness classification (CWE)
References
- 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 (vendor-advisory)
- 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6 (third-party-advisory)