CVE-2026-92683: Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

Q: Which deployments are affected?

Deployments using npm/@neo4j/graphql versions 7.0.0 through versions before 7.6.7 are affected when they use the @authentication directive with a multi-condition JWT where filter written in generic operator syntax.

Q: What does an attacker need to exploit this issue?

An attacker needs an otherwise-valid JWT. No user interaction is required, and the vulnerability can be exploited remotely.

Q: What authorization checks can be bypassed?

For an affected multi-condition JWT where filter, evaluation can bypass every filter condition except the first one. The first condition remains evaluated.

Q: What should be done to remediate the issue?

Update @neo4j/graphql to version 7.6.7 or later. If an immediate update is not possible, identify multi-condition JWT where filters written in generic operator syntax and avoid relying on conditions after the first for authorization.

Published Nov 9, 2026

Updated

Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.

Affected Software

1 affected component

npm/@neo4j/graphql>=7.0.0<7.6.7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @neo4j/graphql to a version that resolves this vulnerability.
Fixed in 7.6.7

Event History

Nov 9, 2026

CVE Published

via MITRE·09:43 AM

Data Sourced

via MITRE·09:43 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using npm/@neo4j/graphql versions 7.0.0 through versions before 7.6.7 are affected when they use the @authentication directive with a multi-condition JWT where filter written in generic operator syntax.

What does an attacker need to exploit this issue?

An attacker needs an otherwise-valid JWT. No user interaction is required, and the vulnerability can be exploited remotely.

What authorization checks can be bypassed?

For an affected multi-condition JWT where filter, evaluation can bypass every filter condition except the first one. The first condition remains evaluated.

What should be done to remediate the issue?

Update @neo4j/graphql to version 7.6.7 or later. If an immediate update is not possible, identify multi-condition JWT where filters written in generic operator syntax and avoid relying on conditions after the first for authorization.

CVE-2026-92683: Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What authorization checks can be bypassed?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What authorization checks can be bypassed?

What should be done to remediate the issue?