GHSA-hx78-272p-mqqh
Authorization Bypass in graphql-shield
GHSA-hx78-272p-mqqh is a vulnerability with no CVSS score yet in graphql-shield, published September 3, 2020. No source lists public exploit code. Fixed in graphql-shield 6.0.6.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.0.6graphql-shield
Description
Versions of graphql-shield prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option no_cache relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.
Recommendation
Upgrade to version 6.0.6 or later.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
graphql-shieldnpm | before 6.0.6 | 6.0.6 |
What each source reports
GitHub AdvisoriesNo score
Authorization Bypass in graphql-shield
Versions of graphql-shield prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option no_cache relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.
Recommendation
Upgrade to version 6.0.6 or later.
- Record
GHSA-hx78-272p-mqqh- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVNo score
Authorization Bypass in graphql-shield
Versions of graphql-shield prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option no_cache relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.
Recommendation
Upgrade to version 6.0.6 or later.
- Record
GHSA-hx78-272p-mqqh- Weakness
- CWE-285
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.