Loading story…
A high-severity flaw tracked as CVE-2026-5423 was disclosed in the @neo4j/graphql library, allowing unauthenticated remote attackers to bypass subscription authentication over GraphQL WebSocket connections. The issue stems from the library accepting a pre-decoded JWT object supplied in connectionParams.jwt without verification, causing forged claims to be treated as an authenticated identity during subscription setup.
Successful exploitation can let attackers evade controls enforced by @authentication and @subscriptionsAuthorization directives and receive subscription events intended only for specific users or roles, creating risks of information disclosure, spoofing, and security restriction bypass. Affected releases include 7.0.0 through before 7.5.6, 5.0.0 through before 5.12.14, and all 6.x versions through 6.6.4; Neo4j has advised customers to upgrade to 7.5.6+ or 5.12.14+, while the 6.x branch is end-of-life and will not receive a fix.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A new CVE, CVE-2026-5423, was recorded for the @neo4j/graphql library. The flaw allows unauthenticated remote clients using GraphQL-over-WebSocket subscriptions to supply a pre-decoded JWT object in connectionParams and have forged claims accepted as authenticated identity.
Neo4j advised users to upgrade @neo4j/graphql to version 7.5.6 or later or 5.12.14 or later to remediate the vulnerability. The vendor also stated that the 6.x branch is end-of-life and will not receive a fix.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **maximum-severity authentication bypass** was disclosed in *pac4j*’s JWT component (*pac4j-jwt*), tracked as **CVE-2026-29000**, affecting a widely used Java security engine embedded across many downstream software packages. The issue is a **logic flaw** that enables attackers to bypass authentication controls by crafting tokens/claims in a way that defeats expected verification, raising concern because exploitation can be relatively straightforward and the library’s transitive use complicates exposure tracking and patch rollout across dependent applications. Public **proof-of-concept (PoC)** code is available, and reporting indicates an attacker who can obtain a target server’s **RSA public key** (often publicly accessible) can forge a **JWE-wrapped PlainJWT** containing arbitrary `sub` and role claims to bypass signature verification and authenticate as any user, including administrators. The pac4j maintainer disclosed the defect and released patched versions shortly after private reporting; while there were no confirmed in-the-wild exploits at the time of reporting, defenders should expect downstream vendors and application owners to issue their own advisories and updates as they assess inherited risk from bundled pac4j versions.
Jun 29, 2026
A public proof-of-concept exploit is available for **CVE-2026-84115**, a high-severity authentication-bypass and privilege-escalation flaw in Cleo Harmony's JWT refresh-token handling. Remote attackers can manipulate Bearer-token arguments sent to the `/api/connections` endpoint to bypass access controls and obtain elevated, potentially administrative, permissions; some attack paths may not require valid credentials. The vulnerability affects Cleo Harmony versions through `5.8.1.10` and could expose managed file-transfer data or enable manipulation of connected integration workflows, particularly on internet-exposed deployments. Cleo fixed the issue in version `5.8.1.11`; organizations should upgrade immediately and review API and token activity for suspicious requests while remediation is underway. No confirmed in-the-wild exploitation of this specific flaw was reported.
Sep 3, 2026
Siemens disclosed **CVE-2026-56451**, a critical authentication-bypass vulnerability in **Opcenter X** caused by improper validation of the algorithm specified in a JSON Web Token (**JWT**) header. The flaw affects **all versions earlier than `V2604`** and allows an **unauthenticated remote attacker** to forge arbitrary JWTs, bypass authentication, impersonate any user including administrators, and potentially obtain full unauthorized access to the application. The issue is classified as **CWE-347** and was assigned a **CVSS v3.1 vector** of `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, with reporting indicating a **maximum severity score of 10.0** under both CVSS 3.1 and 4.0. Siemens identified **`V2604`** as the remediation release through its ProductCERT advisory, and no active exploitation was reported at disclosure, although the attack class is considered highly exploitable because JWT algorithm confusion techniques are well known and broadly tooled.
Jul 16, 2026