CVE-2026-1471 (GCVE-0-2026-1471)

Vulnerability from cvelistv5 – Published: 2026-03-11 16:30 – Updated: 2026-03-11 20:09
VLAI
Title
Caching of authentication context
Summary
Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).  We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.
Severity
2.1 (Low)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear
CWE
  • CWE-863 - Incorrect Authorization
Assigner
References
URL Tags
https://neo4j.com/security/CVE-2026-1471 vendor-advisory
Impacted products
Vendor Product Version
Neo4j Enterprise edition Affected: 2025.01 , < 2026.01.4 (date)
Affected: 4.4.0 , < 5.26.22 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-1471",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-11T20:08:47.580869Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-11T20:09:18.652Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Enterprise edition",
          "vendor": "Neo4j",
          "versions": [
            {
              "lessThan": "2026.01.4",
              "status": "affected",
              "version": "2025.01",
              "versionType": "date"
            },
            {
              "lessThan": "5.26.22",
              "status": "affected",
              "version": "4.4.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2026.01.4",
                  "versionStartIncluding": "2025.01",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.26.22",
                  "versionStartIncluding": "4.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u0026nbsp;\u003cbr\u003eWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.\u0026nbsp;"
            }
          ],
          "value": "Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u00a0\nWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NO",
            "Recovery": "USER",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "CLEAR",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "DIFFUSE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "LOW"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-11T16:30:24.053Z",
        "orgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
        "shortName": "Neo4j"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://neo4j.com/security/CVE-2026-1471"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Caching of authentication context",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003ccode\u003eSet dbms.security.oidc.\u0026lt;provider\u0026gt;.get_groups_from_user_info\u003c/code\u003e and\u0026nbsp;\u003ccode\u003edbms.security.oidc.\u0026lt;provider\u0026gt;.get_username_from_user_info to false.\u003c/code\u003e\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "Set dbms.security.oidc.\u003cprovider\u003e.get_groups_from_user_info and\u00a0dbms.security.oidc.\u003cprovider\u003e.get_username_from_user_info to false."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6",
    "assignerShortName": "Neo4j",
    "cveId": "CVE-2026-1471",
    "datePublished": "2026-03-11T16:30:24.053Z",
    "dateReserved": "2026-01-27T09:09:22.753Z",
    "dateUpdated": "2026-03-11T20:09:18.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-1471",
      "date": "2026-05-31",
      "epss": "0.00071",
      "percentile": "0.21934"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-1471\",\"sourceIdentifier\":\"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6\",\"published\":\"2026-03-11T17:16:54.160\",\"lastModified\":\"2026-03-12T21:08:22.643\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u00a0\\nWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.\"},{\"lang\":\"es\",\"value\":\"El almacenamiento en cach\u00e9 excesivo del contexto de autenticaci\u00f3n en versiones de Neo4j Enterprise edition anteriores a 2026.01.4 lleva a que los usuarios autenticados hereden el contexto del primer usuario que se autentic\u00f3 despu\u00e9s del reinicio. El problema se limita a ciertas configuraciones no predeterminadas de SSO (punto final UserInfo). Recomendamos actualizar a las versiones 2026.01.4 (o 5.26.22) donde el problema est\u00e1 solucionado.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Clear\",\"baseScore\":2.1,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"LOW\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NO\",\"Recovery\":\"USER\",\"valueDensity\":\"DIFFUSE\",\"vulnerabilityResponseEffort\":\"LOW\",\"providerUrgency\":\"CLEAR\"}}]},\"weaknesses\":[{\"source\":\"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"references\":[{\"url\":\"https://neo4j.com/security/CVE-2026-1471\",\"source\":\"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-1471\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-11T20:08:47.580869Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-11T20:08:55.401Z\"}}], \"cna\": {\"title\": \"Caching of authentication context\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"USER\", \"baseScore\": 2.1, \"Automatable\": \"NO\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"valueDensity\": \"DIFFUSE\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"CLEAR\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Neo4j\", \"product\": \"Enterprise edition\", \"versions\": [{\"status\": \"affected\", \"version\": \"2025.01\", \"lessThan\": \"2026.01.4\", \"versionType\": \"date\"}, {\"status\": \"affected\", \"version\": \"4.4.0\", \"lessThan\": \"5.26.22\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://neo4j.com/security/CVE-2026-1471\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Set dbms.security.oidc.\u003cprovider\u003e.get_groups_from_user_info and\\u00a0dbms.security.oidc.\u003cprovider\u003e.get_username_from_user_info to false.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003ccode\u003eSet dbms.security.oidc.\u0026lt;provider\u0026gt;.get_groups_from_user_info\u003c/code\u003e and\u0026nbsp;\u003ccode\u003edbms.security.oidc.\u0026lt;provider\u0026gt;.get_username_from_user_info to false.\u003c/code\u003e\u003cbr\u003e\u003cbr\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\\u00a0\\nWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).\u0026nbsp;\u003cbr\u003eWe recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.\u0026nbsp;\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-863\", \"description\": \"CWE-863 Incorrect Authorization\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"2026.01.4\", \"versionStartIncluding\": \"2025.01\"}, {\"criteria\": \"cpe:2.3:a:neo4j:enterprise_edition:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.26.22\", \"versionStartIncluding\": \"4.4.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6\", \"shortName\": \"Neo4j\", \"dateUpdated\": \"2026-03-11T16:30:24.053Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-1471\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-11T20:09:18.652Z\", \"dateReserved\": \"2026-01-27T09:09:22.753Z\", \"assignerOrgId\": \"3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6\", \"datePublished\": \"2026-03-11T16:30:24.053Z\", \"assignerShortName\": \"Neo4j\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.