Authentication Bypass in NL Portal Backend Libraries for Dutch Government Portals

CVE-2026-49462

What is CVE-2026-49462?

The NL Portal Backend Libraries, used in Dutch government portals, have a significant vulnerability that exposes two GraphQL developer features without any authentication requirement in versions up to 3.0.0. This includes access to the GraphiQL playground, an interface for executing GraphQL queries, and the ability to perform schema introspection. These features can be exploited by anyone who can reach the /graphiql endpoint, allowing them to interact with the API and retrieve detailed schema information. While this vulnerability does not directly leak user data, it simplifies the process for potential attackers to discover and exploit additional weaknesses within the API. The issue has been resolved in version 3.0.1, and users are advised to override specific settings in their deployed configuration as an additional precaution.

References