CVE-2026-1524 is an access control flaw in the single sign on support of Neo4j Enterprise, scored 9.8 (critical). If you configure several OIDC providers and mark some as authentication only, those providers can also grant authorization. Neo4j recommends upgrading to 2026.02 or 5.26.22. Check your configuration first, because only some setups are affected.
What's affected
- Product: Neo4j Enterprise edition.
- Affected: versions before 2026.02.
- Fixed: 2026.02 or 5.26.22, as recommended in Neo4j's notice.
- Conditions, all required: two or more OIDC providers are configured, at least one is set as an authorization provider, and at least one is set as authentication only. The authentication only providers then also provide authorization.
- When it becomes a security problem: only if an authentication only provider contains groups with higher privileges than the ones from the intended authorization provider.
- Also: Neo4j says that with multiple authentication and authorization plugins, a plugin set to provide only one capability could erroneously provide both.
- Severity: 9.8 with the record's CWE-287 (improper authentication) and CWE-863 (incorrect authorization). Not on the CISA Known Exploited Vulnerabilities list.
How to check if you're exposed
Start with the edition and version. Community edition is not mentioned in the notice, which refers to Enterprise. In a Cypher shell, run:
CALL dbms.components() YIELD name, versions, edition RETURN name, versions, edition;
Then read your configuration. Open neo4j.conf and review the authentication and authorization provider settings and any OIDC provider blocks. Count the OIDC providers, and write down for each one whether it is meant to authenticate, authorize, or both.
Finally compare group names. If an authentication only provider issues group claims, check whether any of those groups map to roles with more privilege than your intended authorization provider assigns. That is the case Neo4j describes as a real problem. If the groups do not map to anything privileged, you are lower risk, though the upgrade is still the right fix.
What to do now
- Identify Neo4j Enterprise instances that use more than one OIDC provider, or more than one authentication or authorization plugin.
- Upgrade those instances to 2026.02, or to 5.26.22 on the 5.26 line.
- Until upgrade, review group claims from authentication only providers and make sure none map to privileged roles.
- List the users and roles that hold admin level access and compare them with who should have it.
- Review authentication and audit logs for logins from the authentication only provider that received elevated roles.
- Document the intended role of each identity provider in your configuration notes.
Why it matters
This is a configuration dependent flaw, which makes it unusually clear to reason about. Nothing is wrong with a single provider setup. The trouble appears when an administrator makes a sensible choice, one provider to prove who a user is and another to say what the user may do, and the software does not honor the split. Both identity sources end up providing authorization, so a group name in the wrong place can carry privilege it was never meant to have.
The record uses CWE-287 and CWE-863, authentication and authorization failures. The distinction between them is the center of this bug. Authentication answers who you are. Authorization answers what you may do. Systems that separate the two give you finer control, for example letting a corporate identity provider handle logins while a Neo4j specific source decides roles. Anything that blurs the line breaks the model the administrator thought they had built.
Neo4j's notice is careful about scope. It says the issue matters only when the extra provider contains groups with higher privileges than the intended one. That is a question about your data, not just your version, and it is the sort of thing an inventory with version numbers alone cannot answer. Record the answer next to the ticket so the next reviewer does not have to rediscover it.
A good habit after an upgrade is to test the intended behavior directly: log in as a user who exists only in the authentication only provider and confirm that the user receives no roles beyond the defaults you intended.
Try it yourself
Configuration dependent flaws need a place to record why you are or are not exposed. This demo shows tracking a vulnerability through to closure.
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use one OIDC provider?
Neo4j's notice says it applies only when multiple OIDC providers, or multiple authentication plugins, are configured with separate authentication and authorization intent.
Which fixed versions does Neo4j recommend?
The notice recommends 2026.02, or 5.26.22 for the 5.26 line.
Sources
Last reviewed: 19 October 2026.
