CVE-2026-1471 Caching of authentication context

What is CVE-2026-1471?

CVE-2026-1471 is a low-severity authentication bypass vulnerability in Neo4j Enterprise edition, published on 11 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Excessive caching of authentication context in Neo4j Enterprise edition versions prior to 2026.01.4 leads to authenticated users inheriting the context of the first user who authenticated after restart. The issue is limited to certain non-default configurations of SSO (UserInfo endpoint).  We recommend upgrading to versions 2026.01.4 (or 5.26.22) where the issue is fixed.

Weakness: CWE-863

Which versions are affected by CVE-2026-1471?

2 open source packages ship an affected version, including neo4j-enterprise and neo4j. It affects 1 product.

Products include Neo4j Neo4j.

How do I fix CVE-2026-1471?

Upgrade neo4j-enterprise to a fixed version for your release line: 5.26.22 or 2026.1.4.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-1471 being exploited?

There is no known exploitation of CVE-2026-1471 in the wild and no public exploit code.

Other vulnerabilities in Neo4j Enterprise edition

• CVE-2021-34371 Deserialization of Untrusted Data in Neo4j Critical 9.8
• CVE-2018-18389 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication Critical 9.8
• CVE-2013-7259 Neo4J vulnerable to Cross-Site Request Forgery Medium 6.8
• CVE-2024-34517 Neo4j Cypher component mishandles IMMUTABLE privileges Medium 6.5
• CVE-2026-14587 Unathenticated connection can hold Bolt channel open Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-neo4j-2026-1471, BIT-neo4j-enterprise-2026-1471, GHSA-4g98-g8wp-gw9f, MINI-39q9-39jg-42pc, MINI-3r62-hc24-grfg, MINI-5hr6-9rw7-5p7g and 6 more.