CVE-2026-1524
SSO Authorization Bypass in Neo4j Enterprise via OIDC Misconfiguration
Publication date: 2026-03-11
Last updated on: 2026-03-11
Assigner: Neo4j
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| neo4j | enterprise | to 2026.02 (exc) |
| neo4j | enterprise | to 5.26.22 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-863 | The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-1524 is a security vulnerability in the Single Sign-On (SSO) implementation of Neo4j Enterprise edition versions prior to 2026.02. It occurs when a Neo4j administrator configures two or more OpenID Connect (OIDC) providers, assigning some as authorization providers and others as authentication-only providers.
Due to an edge case, the authentication-only providers incorrectly also grant authorization capabilities. This means that providers intended only to verify identity can also grant access rights.
This misconfiguration can lead to unauthorized access if the authentication-only provider includes user groups with higher privileges than those assigned by the intended authorization provider.
The vulnerability specifically affects setups using multiple plugins for authentication and authorization, where a plugin intended to provide only one capability erroneously provides both, potentially escalating privileges beyond what was intended.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized access in your Neo4j Enterprise environment.
If an authentication-only provider mistakenly grants authorization, users or groups may gain higher privileges than intended.
This privilege escalation can compromise the security of your data and systems by allowing users to perform actions they should not be authorized to do.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, it is recommended to upgrade Neo4j Enterprise edition to version 2026.02 or later, where the issue is fixed.
Additionally, review your configuration of OpenID Connect (OIDC) providers to ensure that authentication-only providers are not inadvertently granting authorization capabilities, especially if they include groups with higher privileges.