Strawberry GraphQL is a library for creating GraphQL APIs. Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscripti…

Strawberry GraphQL library versions up to 0.312.3 contain an authentication bypass vulnerability in WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler fails to verify connection_init handshake completion before processing start messages. Remote attackers can exploit this by connecting with the graphql-ws subprotocol and sending start messages directly, bypassing the on_ws_connect authentication hook without sending connection_init. The vulnerability is fixed in version 0.312.3.