CVE-2026-1471: Neo4j Enterprise Auth Bypass Vulnerability

CVE-2026-1471 Overview

CVE-2026-1471 is an authorization bypass vulnerability affecting Neo4j Enterprise edition that stems from excessive caching of authentication context. In affected versions prior to 2026.01.4, authenticated users may inherit the authentication context of the first user who authenticated after a server restart. This behavior can lead to unauthorized access to data or functionality that should be restricted based on user identity.

The vulnerability is specifically limited to certain non-default configurations utilizing Single Sign-On (SSO) with the UserInfo endpoint. Organizations using standard authentication methods or default SSO configurations are not affected by this issue.

Critical Impact

Authenticated users may inadvertently gain access to resources belonging to other users through inherited authentication context, potentially leading to unauthorized data access or privilege misuse.

Affected Products

• Neo4j Enterprise edition versions prior to 2026.01.4
• Neo4j Enterprise edition versions prior to 5.26.22

Discovery Timeline

• 2026-03-11 - CVE-2026-1471 published to NVD
• 2026-03-12 - Last updated in NVD database

Technical Details for CVE-2026-1471

Vulnerability Analysis

This vulnerability is classified under CWE-863 (Incorrect Authorization), which occurs when software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In the context of Neo4j Enterprise edition, the authentication caching mechanism fails to properly isolate user sessions when SSO with UserInfo endpoint is configured.

When the Neo4j server restarts, the first user to authenticate establishes an authentication context that gets excessively cached. Subsequent users who authenticate may incorrectly inherit this cached context rather than establishing their own independent session, effectively assuming the identity and permissions of that initial user.

The vulnerability requires network access and user interaction to exploit, as an attacker must be an authenticated user on the system. The impact is constrained to scenarios where specific non-default SSO configurations are in use, limiting the exposure footprint.

Root Cause

The root cause of CVE-2026-1471 lies in the improper handling of authentication context caching within Neo4j's SSO implementation. When configured to use the UserInfo endpoint for SSO authentication, the system fails to properly invalidate or segregate cached authentication contexts between different user sessions. This results in authentication context persistence that crosses user boundaries after server restarts.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to be an authenticated user on the affected Neo4j Enterprise system. The exploitation scenario involves:

1. The Neo4j Enterprise server is restarted
2. A user with elevated privileges authenticates to the system via SSO (UserInfo endpoint configuration)
3. Their authentication context is cached by the vulnerable caching mechanism
4. A subsequent attacker-controlled authenticated user logs in
5. The attacker inherits the cached authentication context of the first user
6. The attacker can now access resources and perform actions as if they were the first user

The vulnerability cannot be exploited remotely without authentication, and it requires the specific non-default SSO configuration to be in place. For more technical details, refer to the Neo4j Security Advisory for CVE-2026-1471.

Detection Methods for CVE-2026-1471

Indicators of Compromise

• Audit logs showing users accessing resources outside their normal permission scope
• Authentication events where user identity metadata doesn't match expected session attributes
• Anomalous access patterns following server restarts, particularly within SSO-authenticated sessions
• Multiple users appearing to operate under the same authentication context in application logs

Detection Strategies

• Monitor Neo4j audit logs for authorization decisions that grant access to resources users shouldn't have permissions to access
• Implement session tracking to detect when a user's effective permissions differ from their expected role assignments
• Create alerts for access pattern anomalies that occur within a configurable window after server restarts
• Review SSO integration logs for inconsistencies between identity provider assertions and Neo4j session attributes

Monitoring Recommendations

• Enable comprehensive audit logging in Neo4j Enterprise to capture all authentication and authorization events
• Establish baseline user behavior profiles to detect deviations that may indicate context inheritance
• Configure alerting on server restart events combined with subsequent unusual access patterns
• Regularly review authentication logs for signs of context confusion between user sessions

How to Mitigate CVE-2026-1471

Immediate Actions Required

• Upgrade Neo4j Enterprise edition to version 2026.01.4 or 5.26.22 where the vulnerability is fixed
• Review current SSO configuration to determine if the non-default UserInfo endpoint configuration is in use
• Audit access logs following recent server restarts to identify potential exploitation
• Consider temporarily switching to alternative authentication methods if immediate patching is not possible

Patch Information

Neo4j has released patched versions that address this authentication context caching vulnerability:

• Version 2026.01.4 - Primary recommended upgrade path for 2026.x installations
• Version 5.26.22 - Alternative patched version for organizations on the 5.x branch

Administrators should upgrade to one of these versions as soon as possible. Detailed patch information and upgrade instructions are available in the Neo4j Security Advisory for CVE-2026-1471.

Workarounds

• If using SSO with UserInfo endpoint configuration, consider switching to an alternative SSO configuration method until patching is complete
• Implement additional application-layer authorization checks to validate user identity on sensitive operations
• Restrict server restart operations to maintenance windows with minimal user activity
• Monitor for and manually invalidate suspicious sessions following server restarts

# Configuration example - Review and modify Neo4j SSO configuration
# Check current SSO configuration in neo4j.conf
grep -i "dbms.security.oidc" /var/lib/neo4j/conf/neo4j.conf

# If using UserInfo endpoint, consider alternative authentication
# until patch can be applied - consult Neo4j documentation for
# configuration options specific to your environment