{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "7.0.0"
              },
              {
                "fixed": "7.5.6"
              },
              {
                "introduced": "5.0.0"
              },
              {
                "fixed": "5.12.14"
              },
              {
                "introduced": "6.0.0"
              },
              {
                "last_affected": "6.6.4"
              }
            ],
            "source": "AFFECTED_FIELD"
          },
          "events": [
            {
              "introduced": "16bb032f8a6ffa1d3348a228c6f2b89eeefdb4a5"
            },
            {
              "fixed": "57c53493949e67f3bf72c2b29370632d61aae95e"
            },
            {
              "introduced": "4777c9ca6bb31a6560ce465ca9ea81bfac121537"
            },
            {
              "fixed": "42c91ebed8d28b9391076979ea8ce3875b83cb82"
            },
            {
              "introduced": "2d8a04046d6735b5abd8510a68f1a90ef585675d"
            },
            {
              "last_affected": "02c5a802f5d2f689bf4751cd6109513479518bd4"
            }
          ],
          "repo": "https://github.com/neo4j/graphql",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-fcpg-3fw5-vc65"
  ],
  "database_specific": {
    "cna_assigner": "Neo4j",
    "cwe_ids": [
      "CWE-302"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5423.json"
  },
  "details": "@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users.\nUpgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.",
  "id": "CVE-2026-5423",
  "modified": "2026-08-12T03:51:27.494003125Z",
  "published": "2026-08-06T15:15:29.124Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://registry.npmjs.org"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5423.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65"
    },
    {
      "type": "ADVISORY",
      "url": "https://neo4j.com/security/CVE-2026-5423"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5423"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/neo4j/graphql"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Subscription Authentication Bypass via Unverified connectionParams.jwt"
}