{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://registry.npmjs.org","packageName":"@neo4j/graphql","product":"@neo4j/graphql","source":"CNA: Neo4j","vendor":"Neo4j","versions":[{"lessThan":"7.6.7","status":"affected","version":"7.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-92683","cwes":["CWE-863"],"description":"Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions 7.0.0 before 7.6.7 allows an attacker holding an otherwise-valid JWT to bypass all but the first filter condition via a multi-condition jwt where filter written in generic operator syntax.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.6,"severity":"high","source":"CNA: Neo4j","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1794217398366,"publishedAt":1794217398366,"references":[{"source":"CNA: Neo4j","tags":["vendor-advisory"],"url":"https://github.com/neo4j/graphql/security/advisories/GHSA-58qp-3mmm-5vh8"}],"remediation":[{"kind":"fix","source":"CNA: Neo4j","text":"Upgrade @neo4j/graphql to version 7.6.7 or later."},{"kind":"workaround","source":"CNA: Neo4j","text":"For versions prior to 7.6.7, express multi-condition jwt where filters either with an explicit AND array (for example jwt: { AND: [{ iss: { eq: \"https://idp.example.com\" } }, { roles: { includes: \"admin\" } }] }) or with the inline operator syntax (for example roles_INCLUDES: \"admin\"). Both forms evaluate all conditions."}],"revision":"1549c213252b1a070556caa4d74942f5c5710cb8f383a7bdd5469647411fbb52","sources":[{"modifiedAt":1794217398366,"name":"CNA: Neo4j","retrievedAt":1794218960040,"url":"https://www.cve.org/CVERecord?id=CVE-2026-92683"}],"ssvc":null,"status":"published","title":"Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql","updatedAt":1794218960040}