CVE-2026-35523: Strawberry Graphql Ws Unauthenticated Startcve-2026-35523-strawberry-graphql-ws-unauthenticated-start
The `handle_start` method of a GraphQL WebSocket handler processes subscription messages without first checking if the connection has been initialized and acknowledged. This allows attackers to bypass authentication implemented in the `connection_init` hook (e.g., `on_ws_connect`) by sending a `start` message directly. Ensure that a property like `self.conne
