CVE-2026-92683 · Package
NO FIX YET · SEE WHAT TO DO
In @neo4j/graphql versions 7.0.0 before 7.6.7, a JWT authorization filter with multiple conditions only enforces the first one. An attacker holding an otherwise valid JWT can read or act on data that the remaining conditions should have blocked.
first public Nov 5, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use @neo4j/graphql 7.x with the @authentication directive and JWT-based where filters written in generic operator syntax. Apps without JWT authorization filters, or on versions outside 7.0.0 to 7.6.6, are not affected by this description.
Not affected if no-jwt-where-filter, version-outside-range
Who cares graphql, jwt, neo4j, node.js
npm ls @neo4j/graphql@authentication directives with multiple conditions in a jwt where filter, written in generic operator syntax@neo4j/graphql 7.6.7 or later (from the affected range 7.0.0 before 7.6.7)Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.