CVE-2026-118665: GraphQL Tools retains WebSocket authentication parameters for later users

@graphql-tools/executor-legacy-ws retains previous request extensions.connectionParams values after the shared executor's socket is closed. When the same executor serves different users or authorization contexts, the next request's WebSocket connection_init data may contain the previous user's Authorization or tenant values. The source describes a validated proof of concept; it does not confirm active exploitation.