CVE-2026-5423
CVE-2026-5423 is a high-severity vulnerability with a CVSS 4.0 base score of 8.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-302.
Key facts
- Severity: High (CVSS 4.0 base score 8.2)
- EPSS exploit prediction: 0% (27th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-302
- Published:
- Last modified:
Description
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.
Frequently asked questions
- What is CVE-2026-5423?
- @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.
- How severe is CVE-2026-5423?
- CVE-2026-5423 has a CVSS 4.0 base score of 8.2, rated high severity.
- Is CVE-2026-5423 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2026-5423?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2026-5423 published?
- CVE-2026-5423 was published on 2026-08-06 and last updated on 2026-08-18.
References
- https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65
- https://neo4j.com/security/CVE-2026-5423
Other CWE-302 vulnerabilities
- CVE-2026-48781 — Critical (CVSS 9.9): Postiz is an AI social media scheduling tool. In versions prior to 2.21.8, the Skool integration callback signed an…
- CVE-2024-56404 — Critical (CVSS 9.9): In One Identity Identity Manager 9.x before 9.3, an insecure direct object reference (IDOR) vulnerability allows…
- CVE-2024-43441 — Critical (CVSS 9.8): Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. This issue affects Apache…
- CVE-2025-47158 — Critical (CVSS 9.0): Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges…
- CVE-2024-12838 — High (CVSS 8.8): The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass…
- CVE-2026-50528 — High (CVSS 8.2): Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network.