← CVE Intelligence

CVE-2026-41700

Cross-Site WebSocket Hijacking in Spring for GraphQL PUBLISHED

Description (CNA)

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials. Affected versions: Spring for GraphQL 2.0.0 through 2.0.3; 1.4.0 through 1.4.5; 1.3.0 through 1.3.8; 1.0.0 through 1.0.6.

Affected (CNA)

Vendor / productVersions
Spring / Spring for GraphQLaffected 2.0.0 before 2.0.3.1; affected 1.4.0 before 1.4.5.1; affected 1.3.0 before 1.3.9; affected 1.0.0 before 1.0.7

CWE

CWE-346

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.