CVE-2026-92683 | BDVDB-2026-402170 Detail
Neo4j@neo4j/graphql
Description#
Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.
Impact#
Authorization bypass: JWT claim requirements beyond the first condition (such as a required role) are not enforced, allowing access to data or operations protected by @authentication.
Weaknesses#
- CWE-863 Incorrect Authorization
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.