CVE-2026-1471: Caching of authentication context
Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint). We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-1471?
CVE-2026-1471 has a high severity due to potential unauthorized access to user authentication contexts.
How do I fix CVE-2026-1471?
To fix CVE-2026-1471, update to Neo4j Enterprise edition version 2026.01.4 or later.
What type of configurations are affected by CVE-2026-1471?
CVE-2026-1471 affects certain non-default configurations in Neo4j Enterprise edition.
Who is affected by CVE-2026-1471?
Authenticated users of Neo4j Enterprise edition versions prior to 2026.01.4 are affected by CVE-2026-1471.
What does CVE-2026-1471 lead to?
CVE-2026-1471 leads to authenticated users inheriting the context of the first user who logged in after the system restart.