---
id: "CVE-2026-92683"
page: "https://infrastack.ai/live/CVE-2026-92683"
kind: "vulnerability"
aliases: ["CVE-2026-92683"]
title: "Neo4j GraphQL library: JWT filter checks skipped, bypassing access rules"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["graphql", "jwt", "neo4j", "node.js", "package"]
not_affected_if: ["no-jwt-where-filter", "version-outside-range"]
published_at: "2026-11-09T10:17:15+00:00"
first_seen_at: "2026-11-09T10:25:50+00:00"
updated_at: "2026-11-09T10:26:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92683", "first_seen_at": "2026-11-09T10:25:50+00:00"}]
exploit_sources: []
---

# Neo4j GraphQL library: JWT filter checks skipped, bypassing access rules

Link for people: https://infrastack.ai/live/CVE-2026-92683 (this .md is for agents)

In @neo4j/graphql versions 7.0.0 before 7.6.7, a JWT authorization filter with multiple conditions only enforces the first one. An attacker holding an otherwise valid JWT can read or act on data that the remaining conditions should have blocked.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version: `npm ls @neo4j/graphql`
- Look for `@authentication` directives with multiple conditions in a `jwt` `where` filter, written in generic operator syntax

## Fix

- `@neo4j/graphql` `7.6.7` or later (from the affected range 7.0.0 before 7.6.7)

## Timeline

- 2026-11-09T10:25:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92683

## Documents

- [advisory] Vendor advisory: github.com https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8

## From the sources

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_