Spring for GraphQL applications that enable the WebSocket transport are vulnerable to a cross‑site WebSocket hijacking flaw. The vulnerability allows an attacker to create a malicious web page that tricks an authenticated user into establishing a WebSocket connection to a trusted GraphQL endpoint. When the connection is established, the attacker’s page can send arbitrary GraphQL queries and mutations, causing the victim’s credentials to be used for malicious actions. The weakness is a type of reference‑owned token reuse, reflected by CWE‑346.

All versions of Spring for GraphQL from 1.0.0 through 1.0.6, 1.3.0 through 1.3.8, 1.4.0 through 1.4.5, and 2.0.0 through 2.0.3 are affected regardless of vendor installation. Any deployment that has enabled WebSocket transport for GraphQL is considered vulnerable.

The CVSS score of 8.1 signals a high severity risk. The EPSS score is currently not available, but the vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation at the time of analysis. The likely attack vector is a deceptive web page that forces an authenticated user to connect to the victim’s GraphQL endpoint. Successful exploitation grants the attacker full access to perform arbitrary operations with the victim’s privileges, posing a serious risk to confidentiality and integrity of the GraphQL data.