The Neo4j GraphQL library allows an unauthenticated attacker to supply a pre‑decoded JWT in the GraphQL subscription connectionParams without verifying its signature. Because the server trusts the client‑supplied token, forged claims such as sub and roles are accepted by the @authentication and @subscriptionAuthorization directives, enabling the attacker to receive subscription events that should be limited to authenticated users. This represents an authentication bypass that can lead to unauthorized data exposure in subscription streams.

Neo4j GraphQL, any release before version 7.5.6 or 5.12.14. Clients using these earlier releases are vulnerable.

The CVSS score of 8.2 indicates high severity. The exploit is feasible over the GraphQL WebSocket subscription endpoint; an attacker only needs to construct a WebSocket connection and supply the forged JWT. No local constraints are required. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, but the lack of signature verification makes exploitation trivial over the network. The vulnerability allows full authentication bypass for subscription channels, potentially exposing real‑time data to anyone.