# CVE-2026-5423: @neo4j/graphql subscription authentication bypass via unverified JWT

Source: https://junglewise.ai/threats/cve-2026-5423-neo4j-graphql-subscription-authentication-bypass-via-unverified  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-5423 · Severity: info · CVSS 8.2 · Published 2026-08-06

@neo4j/graphql is a library that enables GraphQL queries against Neo4j databases with built-in authentication and authorization controls. Versions prior to 7.5.6 contain an authentication bypass in the WebSocket subscription transport: attackers can forge arbitrary JWT claims without a valid signing key, allowing unauthorized access to real-time data notifications that should be restricted to authenticated users or specific roles. This leads to sensitive data leakage (e.g., real-time change notifications containing database records) accessible to any unauthenticated remote client.

Technologies: [Neo4j @Neo4j/Graphql](https://junglewise.ai/threats/technologies/neo4j-graphql). Vendors: [Neo4j](https://junglewise.ai/threats/vendors/neo4j).

## Quick answers

**Is CVE-2026-5423 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5423 being exploited in the wild.

**How severe is CVE-2026-5423?** Informational severity, with a CVSS score of 8.2, published 6 August 2026.

**Which products and versions are affected?** Neo4j @Neo4j/Graphql 5.0.0 to 5.12.13, 6.0.0 to 6.x (EOL), 7.0.0 to 7.5.5.

**Is there a fix for CVE-2026-5423?** A patch was published on 2026-08-06: Versions 7.5.6 and 5.12.14 released with fix; v6 EOL, no patch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5423 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-5423?** Check whether you run Neo4j @Neo4j/Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass (CWE-287) in @neo4j/graphql's GraphQL subscription handler. The vulnerability exists in versions ≥5.0.0 <5.12.14, ≥6.0.0 (unfixed, EOL), and ≥7.0.0 <7.5.6. The root cause is failure to verify the authenticity/signature of a JWT object passed through GraphQL-over-WebSocket connectionParams before using it for @authentication and @subscriptionsAuthorization directive evaluation. An unauthenticated attacker on the network can open a WebSocket connection to the GraphQL endpoint, inject a forged JWT with arbitrary claims (sub, roles, custom fields) in connectionParams.jwt, and have it accepted as a valid authenticated identity. The precondition is that the target application has subscriptions and authorization features enabled. Patches are available: upgrade to versions 7.5.6+ or 5.12.14+; v6 is end-of-life and will not be patched.

## Affected products

- Neo4j @neo4j/graphql 5.0.0 to 5.12.13, 6.0.0 to 6.x (EOL), 7.0.0 to 7.5.5

## Timeline

- 2026-08-06: disclosed
- 2026-08-06: patched: Versions 7.5.6 and 5.12.14 released with fix; v6 EOL, no patch

## References

- [https://registry.npmjs.org/](https://registry.npmjs.org/)
- [https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65](https://github.com/neo4j/graphql/security/advisories/GHSA-fcpg-3fw5-vc65)

## Related threats

- [Neo4j @neo4j/graphql authentication bypass in aggregation queries](https://junglewise.ai/threats/cve-2026-92684-missing-authentication-for-critical-function-in-aggregation)
- [Neo4j @neo4j/graphql authorization bypass in @authentication JWT filter](https://junglewise.ai/threats/cve-2026-92683-incorrect-authorization-in-the-authentication-directive-jwt-where)
- [Neo4j GraphQL authorization filter logic inversion on relationships](https://junglewise.ai/threats/cve-2026-92682-in-neo4j-graphql-versions-from-7-0-0-up-to-but-not-including-7-6)
- [Neo4j GraphQL authentication bypass in @cypher fields](https://junglewise.ai/threats/cve-2026-92681-in-neo4j-graphql-versions-up-to-and-including-7-6-3)