Neo4j GraphQL EUVD-2026-54094

Exploitation requires that the target application uses @neo4j/graphql for GraphQL subscriptions via WebSocket (graphql-ws transport) and that at least one subscription type is protected by @authentication or @subscriptionsAuthorization directives. The application must also allow unauthenticated WebSocket connection initiation - if a network gateway or reverse proxy enforces bearer-token authentication before a WebSocket upgrade, the vulnerability is mitigated at that layer. The flaw is limited to the subscription authorization path; query and mutation authorization directives are not affected by this specific bypass. Exploitation does not require any prior account, session, or knowledge of a valid user's credentials. What limits impact is that the attacker gains only read access to subscription event streams - no write, delete, or server-side execution capability is exposed by this vulnerability alone.

The CVSS 4.0 score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N) reflects a high-impact, low-complexity, unauthenticated network attack with a specific attack prerequisite (AT:P). The AT:P metric is key: exploitation requires that the target application exposes a GraphQL WebSocket subscription endpoint and uses @authentication or @subscriptionsAuthorization directives. Without those conditions, the library is not vulnerable in practice. The confidentiality impact is high (VC:H) - unauthorized access to subscription event streams - while integrity and availability are unaffected, bounding overall risk. No EPSS data was provided, no CISA KEV listing exists, and no public proof-of-concept has been identified, suggesting this has not yet seen opportunistic exploitation. However, the low technical skill required to craft a forged connectionParams.jwt and the complete absence of any authentication barrier make this a straightforward exploit once an attacker identifies an affected subscription endpoint, so patching should be treated as urgent for any deployment relying on subscription-level authorization.

An unauthenticated attacker identifies an application exposing a @neo4j/graphql WebSocket subscription endpoint that uses @subscriptionsAuthorization directives to gate access to sensitive events (e.g., order updates, private messages, or financial transactions). The attacker initiates a WebSocket connection and passes a crafted connectionParams.jwt object containing forged claims - for example, sub: 'admin' or roles: ['ADMIN'] - without possessing any valid token or credentials. The library accepts these claims as authenticated identity and begins streaming restricted subscription events to the attacker. No public proof-of-concept code has been identified, but the attack requires only standard WebSocket tooling and knowledge of the expected JWT claim structure.