# CVE-2026-92683: Neo4j @neo4j/graphql authorization bypass in @authentication JWT filter

Source: https://junglewise.ai/threats/cve-2026-92683-incorrect-authorization-in-the-authentication-directive-jwt-where  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-09. Updated: 2026-11-09  
License: CC BY 4.0 with a link back

CVE-2026-92683 · Severity: info · Published 2026-11-09

Neo4j @neo4j/graphql is a GraphQL library used to build query layers on top of Neo4j databases. A vulnerability in the @authentication directive causes only the first condition of multi-condition JWT filters to be evaluated, allowing an attacker with a valid JWT to bypass subsequent security conditions such as role checks and gain unauthorized access to protected data.

Technologies: [Neo4j @Neo4j/Graphql](https://junglewise.ai/threats/technologies/neo4j-graphql). Vendors: [Neo4j](https://junglewise.ai/threats/vendors/neo4j).

## Quick answers

**Is CVE-2026-92683 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92683 being exploited in the wild.

**How severe is CVE-2026-92683?** Informational severity, published 9 November 2026.

**Which products and versions are affected?** Neo4j @Neo4j/Graphql 7.0.0 to before 7.6.7.

**Is there a fix for CVE-2026-92683?** Yes: fixed in 7.6.7. Until then: Express multi-condition JWT filters using an explicit AND array syntax (jwt: { AND: [{ iss: { eq: "https://idp.example.com" } }, { roles: { includes: "admin" } }] }) or with inline operator syntax (roles_INCLUDES: "admin") instead of generic operator syntax, both of which evaluate all conditions correctly. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92683 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92683?** Check whether you run Neo4j @Neo4j/Graphql at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7.6.7

Express multi-condition JWT filters using an explicit AND array syntax (jwt: { AND: [{ iss: { eq: "https://idp.example.com" } }, { roles: { includes: "admin" } }] }) or with inline operator syntax (roles_INCLUDES: "admin") instead of generic operator syntax, both of which evaluate all conditions correctly.

## Technical details

The @authentication directive in @neo4j/graphql fails to evaluate all conditions when a JWT where filter uses generic operator syntax with multiple conditions. Only the first condition is evaluated while subsequent conditions are silently ignored. An attacker with a valid JWT that satisfies the first condition (e.g., issuer check) can bypass role or other authorization checks if they are expressed as subsequent conditions, resulting in unauthorized access to protected GraphQL operations and data.

## Affected products

- Neo4j @neo4j/graphql 7.0.0 to before 7.6.7

## Timeline

- 2026-11-05: disclosed
- 2026-11-09: advisory

## References

- [https://registry.npmjs.org/](https://registry.npmjs.org/)
- [https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8](https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8)

## Related threats

- [Neo4j @neo4j/graphql authentication bypass in aggregation queries](https://junglewise.ai/threats/cve-2026-92684-missing-authentication-for-critical-function-in-aggregation)
- [Neo4j GraphQL authorization filter logic inversion on relationships](https://junglewise.ai/threats/cve-2026-92682-in-neo4j-graphql-versions-from-7-0-0-up-to-but-not-including-7-6)
- [Neo4j GraphQL authentication bypass in @cypher fields](https://junglewise.ai/threats/cve-2026-92681-in-neo4j-graphql-versions-up-to-and-including-7-6-3)
- [@neo4j/graphql subscription authentication bypass via unverified JWT](https://junglewise.ai/threats/cve-2026-5423-neo4j-graphql-subscription-authentication-bypass-via-unverified)