An authentication bypass vulnerability in Strawberry GraphQL allows unauthenticated remote attackers to circumvent connection hooks and access sensitive subscription data.

This flaw exists because the legacy graphql-ws subprotocol handler fails to verify that the required connection_init handshake is completed before processing subscription messages. An unauthenticated attacker can bypass the on_ws_connect authentication hook by sending a start message directly to the WebSocket endpoint.

Successful exploitation of this vulnerability permits unauthorized access to GraphQL subscription data, potentially leading to the exposure of sensitive information or unauthorized real-time updates. Given the CVSS score of 7.5, this high-severity issue poses a significant risk to data confidentiality, as it allows attackers to bypass security controls without requiring prior authentication or user interaction.

Immediate Action: Update the strawberry-graphql package to version 0.312.3 or later immediately to enforce proper handshake validation.

Proactive Monitoring: Review application logs for WebSocket connection patterns that lack the expected connection_init handshake sequence, which may indicate attempted exploitation.

Compensating Controls: Implement network-level restrictions or a Web Application Firewall configured to inspect and validate WebSocket subprotocols if an immediate update is not feasible.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability represents a critical failure in the authentication workflow of the affected API library. Organizations utilizing Strawberry GraphQL should prioritize upgrading to version 0.312.3 to ensure that the connection_init handshake is correctly enforced. Failure to patch may expose backend data streams to unauthorized access by any remote actor.