Skip to main content

Neo4j CVE-2026-1524

LOW
Improper Authentication (CWE-287)
2026-03-11 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6
Authentication Bypass Neo4j
2.1
CVSS 4.0 · Vendor: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6

Severity by source

Vendor (3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6) PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Green

Primary rating from Vendor (3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6) · only source for this CVE.

CVSS VectorVendor: 3b236295-4ccd-4a1f-a1c1-a72eecc8d7b6

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
X

Lifecycle Timeline

3
CVSS changed
May 22, 2026 - 16:17 NVD
2.1 (LOW)
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
CVE Published
Mar 11, 2026 - 17:16 nvd
N/A

DescriptionCVE.org

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:

If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.

When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.

We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.

AnalysisAI

An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:

If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provi...

Technical ContextAI

This vulnerability (CWE-287: Improper Authentication) affects An edgecase in SSO implementation in Neo4j Enterprise edition. An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:

If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider

RemediationAI

Monitor vendor advisories for a patch.

More in Neo4j

View all
CVE-2018-1000820 CRITICAL POC
10.0 Dec 20

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in

CVE-2021-34371 CRITICAL POC
9.8 Aug 05

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects,

CVE-2018-18389 CRITICAL POC
9.8 Oct 16

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authenti
CVE-2023-23926 HIGH POC
8.1 Feb 16

APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j. Rated high severity (CVSS 8.1), this vulnerability i
CVE-2022-37423 HIGH POC
7.5 Aug 12

Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling di
CVE-2021-34802 HIGH
8.8 Jul 30

A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 and 4.3 could allow

CVE-2026-5423 HIGH
8.2 Aug 06

JWT authentication bypass in @neo4j/graphql allows unauthenticated remote clients to forge arbitrary JWT claims over Gra
CVE-2026-19869 HIGH
7.6 Aug 18

Authentication bypass in @neo4j/graphql exposes admin-restricted custom-resolver fields to any authenticated user holdin
CVE-2013-7259 MEDIUM
6.8 Apr 29

Multiple cross-site request forgery (CSRF) vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentic
CVE-2024-34517 MEDIUM
6.5 May 07

The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker al
CVE-2026-14587 MEDIUM
5.5 Aug 05

Bolt protocol handshake decoder in Neo4j Enterprise and Community Editions fails to distinguish overlong capability mask
CVE-2026-1337 LOW POC
1.1 Feb 06

Neo4J versions up to 2026.01 contains a vulnerability that allows attackers to XSS if the user opens the logs in a tool

Same weakness CWE-287 – Improper Authentication

View all
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2023-35078 CRITICAL POC
9.8
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-1524 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy