CVE-2026-1524 Auth misconfiguration when multiple providers enabled
Misconfiguration in multi-provider SSO allows authentication-only providers to grant unintended authorization privileges, leading to unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1524?
CVE-2026-1524 is a low-severity authentication bypass vulnerability in neo4j Enterprise Edition, published on 11 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:
If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.
When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.
We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.
Which versions are affected by CVE-2026-1524?
2 open source packages ship an affected version, including neo4j-enterprise and neo4j. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
neo4j-enterprise Bitnami | All versions | 5.26.22, 2026.2.0 |
neo4j Bitnami | All versions | 5.26.22, 2026.2.0 |
Products include Neo4j Neo4j.
How do I fix CVE-2026-1524?
Upgrade neo4j-enterprise to a fixed version for your release line: 5.26.22 or 2026.2.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-1524 being exploited?
There is no known exploitation of CVE-2026-1524 in the wild and no public exploit code.
Other vulnerabilities in neo4j Enterprise Edition
- CVE-2021-34371 Deserialization of Untrusted Data in Neo4j
- CVE-2018-18389 Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
- CVE-2013-7259 Neo4J vulnerable to Cross-Site Request Forgery
- CVE-2024-34517 Neo4j Cypher component mishandles IMMUTABLE privileges
- CVE-2026-14587 Unathenticated connection can hold Bolt channel open
Sources
Also known as BIT-neo4j-2026-1524, BIT-neo4j-enterprise-2026-1524, GHSA-5pgp-mc2w-hjjx, MINI-5q3f-h297-whhp, MINI-63f7-pf2h-4q9w, MINI-6r74-gqhv-2x93 and 7 more.