CVE-2026-1471

—

CVSS 4.0

2.1 low

EPSS

<1%p16

Published

Mar 11, 2026 (Mar 11, 2026)

Modified

Jun 17, 2026

Description

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.

Vendors: neo4j
Products: neo4j
Weakness: CWE-863
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Clear

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.