CVE-2026-1471
Undergoing Analysis Undergoing Analysis - In Progress
Authentication Context Caching Flaw in Neo4j Enterprise Enables Privilege Inheritance

Publication date: 2026-03-11

Last updated on: 2026-05-22

Assigner: Neo4j

Description
Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).  We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-11
Last Modified
2026-05-22
Generated
2026-06-16
AI Q&A
2026-03-11
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1471
EUVD
EUVD-2026-11210
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
neo4j neo4j to 5.26.22 (exc)
neo4j neo4j From 2025.01.0 (inc) to 2026.01.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

I don't know

Impact Analysis

This vulnerability can lead to unauthorized access by allowing users to assume the identity or privileges of another authenticated user due to improper handling of authentication context.

Compliance Impact

I don't know

Executive Summary

CVE-2026-1471 is a security vulnerability in Neo4j Enterprise edition versions prior to 2026.01.4. It involves excessive caching of the authentication context, which causes authenticated users to inherit the authentication context of the first user who logged in after a server restart.

This issue specifically affects certain non-default configurations of Single Sign-On (SSO) that use the UserInfo endpoint.

Mitigation Strategies

To mitigate this vulnerability, it is recommended to upgrade Neo4j Enterprise edition to version 2026.01.4 (or 5.26.22) where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1471. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart