A flaw in strawberry-graphql allows an unauthenticated attacker to bypass authentication on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler fails to verify that a connection_init handshake has taken place before handling start messages. An attacker can therefore skip the on_ws_connect authentication hook and begin a subscription without providing valid credentials, potentially exposing sensitive data or enabling further interaction with the API. The weakness corresponds to an authentication bypass scenario.

This vulnerability affects the strawberry-graphql library for projects using versions earlier than 0.312.3. The flaw exists in the GraphQL library itself and applies to any deployment that accepts WebSocket connections using the legacy graphql-ws subprotocol.

The CVSS score of 7.5 indicates a high severity for remote unauthenticated exploitation. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the absence of a mitigation that requires client credentials suggests that exploitation is likely straightforward for an attacker with network access to the WebSocket endpoint.