Description

Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking.

More precisely, an application is vulnerable when all the following are true:

• the application has enabled the GraphQL WebSocket transport
• the application relies on cookie-based session authentication
• the application does not have custom Spring Security WebSocket-level Origin enforcement configured

When all the conditions above are met, an attacker can trick an authenticated user into visiting a malicious page, allowing the attacker to execute arbitrary GraphQL operations with the victim's credentials.

Affected Spring Products and Versions

Spring for GraphQL:

• 2.0.0 - 2.0.3
• 1.4.0 - 1.4.5
• 1.3.0 - 1.3.8
• 1.0.0 - 1.0.6

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

Credit

This issue was discovered internally.

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.