Back
CVE-2026-1471
Caching of authentication context
Low2.1EPSS 0.28%
- Published
- Updated
- Reserved
- Assigned by
- Neo4j
Description
Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| Neo4jCNA (assigner) | 4.0 | Low2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear |
| NVDNVD · Analyzed | 4.0 | Low2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:L/U:Clear |
- EPSS (exploitation in 30 days)
- 0.28% · top 79% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 2.1.
Weakness
Affected products
- affected 2025.01 – < 2026.01.4
- affected 4.4.0 – < 5.26.22
What to do
Workaround: Set dbms.security.oidc.<provider>.get_groups_from_user_info and dbms.security.oidc.<provider>.get_username_from_user_info to false.
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-1471)Record last updated .