The vulnerability arises from an incorrect evaluation of multi‑condition JSON Web Token (JWT) filters in the @authentication directive of the Neo4j @neo4j/graphql library. When a filter is expressed in generic operator syntax, only the first condition is evaluated, allowing an authorized JWT bearer to bypass the remaining conditions and gain improper access to data or operations. This flaw results in unauthorized data exposure or modification and can be exploited by any party with a valid JWT, potentially enabling a full compromise of the GraphQL API.

Neo4j’s @neo4j/graphql component for all versions from 7.0.0 through 7.6.6 is affected. The fix is available in version 7.6.7 and later, which correctly evaluates all filter conditions in the JWT.

The CVSS score of 8.6 indicates a high‑severity flaw. The EPSS score is not available, but the lack of a KEV listing does not reduce the risk; an attacker with a legitimate JWT can readily construct a multi‑condition filter that only partially enforces authorization. The vulnerability is exploitable without requiring any user interaction, making it a significant threat in environments that rely on default JWT handling in the @neo4j/graphql package.