CyberRota Analysis
AI-GeneratedThe @neo4j/graphql library versions prior to 7.5.6 are vulnerable due to improper verification of client-supplied JWT objects in GraphQL subscription connection parameters, allowing unauthenticated remote clients to forge JWT claims. This vulnerability can lead to unauthorized access to subscription events intended for specific authenticated users or roles. Organizations using affected versions of this library should prioritize upgrading to 7.5.6 or later, or 5.12.14+, to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JWT claims (e.g. sub, roles) in connectionParams.jwt and have them accepted as authenticated identity for the purposes of @authentication and @subscriptionsAuthorization directive evaluation. This allows a fully unauthenticated attacker to receive subscription events that should be restricted to specific authenticated roles/users. Upgrade the library to versions 7.5.6+ or 5.12.14+. v6 is end-of-life and will not receive a fix.