CVE-2026-5423 is an authentication bypass vulnerability in the @neo4j/graphql library where versions prior to 7.5.6 and 5.12.14 do not verify the authenticity of JWT objects supplied by clients in GraphQL subscription connectionParams. This flaw allows unauthenticated attackers who can open GraphQL-over-WebSocket connections to forge JWT claims such as 'sub' and 'roles'. These forged claims are accepted as valid for @authentication and @subscriptionsAuthorization directive evaluation, permitting unauthorized subscription event access. Version 6.x is end-of-life and unpatched.

An unauthenticated remote attacker can bypass authentication controls by forging JWT claims, gaining unauthorized access to subscription events that should be restricted to authenticated users with specific roles. This compromises confidentiality of subscription data and potentially exposes sensitive information to unauthorized parties.

Upgrade the @neo4j/graphql library to version 7.5.6 or later, or 5.12.14 or later. Version 6.x is end-of-life and will not receive a fix, so migration to a supported version is necessary. Patch status is not explicitly stated but the advisory clearly recommends upgrading to these fixed versions.