CVE-2026-1471

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1471
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1471.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1471
Aliases
Downstream
Published
2026-03-11T16:30:24.053Z
Modified
2026-07-08T07:55:29.779502079Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:L/U:Clear CVSS Calculator
Summary
Caching of authentication context
Details

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).  We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "2025.01"
                },
                {
                    "fixed": "2026.01.4"
                },
                {
                    "introduced": "4.4.0"
                },
                {
                    "fixed": "5.26.22"
                }
            ]
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "2025.01"
                },
                {
                    "fixed": "2026.01.4"
                },
                {
                    "introduced": "4.4.0"
                },
                {
                    "fixed": "5.26.22"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1471.json",
    "cna_assigner": "Neo4j",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/neo4j/neo4j

Affected ranges

Type
GIT
Repo
https://github.com/neo4j/neo4j
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b6b4c8fbd8e953c19daf4be1ad1136635465f046
Introduced
aa168a96c066c736faaf121480c2b5572ad0037d
Fixed
158612c97a5b676d6129396ad0c4d5b772c7c2a4
Database specific 
{
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:neo4j:neo4j:*:*:*:*:enterprise:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.26.22"
        },
        {
            "introduced": "2025.01.0"
        },
        {
            "fixed": "2026.01.4"
        }
    ]
}

Affected versions

1.*
1.0.0
1.9
1.9.M02
2.*
2.0.1
2.2.0-M01
2.2.0-M03
2.2.0-RC01
2.3.0-M01
2.3.0-M02
2026.*
2026.01.3
3.*
3.0.0-M01
3.0.0-M02
3.0.0-M03
3.0.0-M04
3.0.0-M05
3.1.0-BETA1
3.1.0-M01
3.1.0-M02
3.1.0-M03
3.1.0-M04
3.1.0-M05
3.1.0-M06
3.1.0-M07
3.1.0-M08
3.1.0-M09
3.1.0-M10
3.1.0-M12-beta2
3.1.0-M13-beta3
3.2.0-alpha01
3.2.0-alpha02
3.2.0-alpha03
3.2.0-alpha04
3.2.0-alpha05
3.2.0-alpha06
3.2.0-alpha07
3.2.0-alpha08
3.2.0-rc1
3.3.0-alpha01
3.3.0-alpha02
3.3.0-alpha03
3.3.0-alpha04
3.3.0-alpha05
3.3.0-alpha06
3.3.0-alpha07
3.3.0-beta01
3.4.0-alpha01
3.4.0-alpha02
3.4.0-alpha03
3.4.0-alpha04
3.4.0-alpha05
3.4.0-alpha06
3.4.0-alpha07
3.4.0-alpha08
3.4.0-alpha09
3.4.0-alpha10
3.4.0-beta01
3.4.0-beta02
3.4.0-rc01
4.*
4.0.0-alpha01
4.0.0-alpha02
4.0.0-alpha03
4.0.0-alpha04
4.0.0-alpha05
4.0.0-alpha06
4.0.0-alpha07mr01
4.0.0-alpha08
4.0.0-alpha09mr02
4.0.0-alpha10
4.0.0-beta01
4.0.0-beta02
4.0.0-beta03mr03
4.1.0-alpha01
4.4.0-alpha01
5.*
5.0.0
5.1.0
5.2.0
5.26.14
5.26.18
5.26.20
5.26.21

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1471.json"