Executive brief
Spring for GraphQL is a framework that enables GraphQL API support in Spring Boot applications, often used for real-time data queries. When WebSocket transport is enabled, the application becomes vulnerable to cross-site WebSocket hijacking attacks. An attacker can trick an authenticated user into visiting a malicious webpage, allowing the attacker to send arbitrary GraphQL requests using the victim's session credentials, potentially exposing sensitive data or making unauthorized modifications.
Technical details
This vulnerability is a cross-site WebSocket hijacking (CSWSH) flaw caused by improper origin validation in the WebSocket connection handler. The root cause is an origin validation error (CWE-346) in the GraphQlWebSocketHandler component. An attacker can craft a malicious web page that, when visited by an authenticated user, initiates a WebSocket connection to the target GraphQL API. Because the WebSocket handshake does not properly validate the origin of the request, the server accepts the connection and processes GraphQL operations using the victim's existing authentication credentials. No special privileges or authentication bypass is required from the attacker; only user interaction (visiting a malicious page) is needed. The attack vector is network-based and can be executed remotely. Patches are available: version 2.0.4, 1.4.6, and later versions include fixes that properly validate WebSocket origins and refuse cross-origin connections.
Affected products
- Spring Spring for GraphQL 2.0.0 through 2.0.3
- Spring Spring for GraphQL 1.4.0 through 1.4.5
- Spring Spring for GraphQL 1.3.0 through 1.3.8
- Spring Spring for GraphQL 1.0.0 through 1.0.6
Timeline
- 2026-06-11: disclosed
- 2026-06-11: patched: Patches released: version 2.0.4, 1.4.6