CVE-2026-1524 neo4j CVE debrief

Who should care

Neo4j Enterprise administrators and security teams using SSO with multiple OIDC providers, especially environments that separate authentication and authorization across plugins or identity providers.

Technical summary

According to the Neo4j advisory, the defect affects Enterprise edition versions prior to 2026.02. When two or more OIDC providers are configured and at least one is set for authorization while another is set for authentication only, the authentication-only provider can incorrectly provide authorization as well. The NVD record lists the issue as low severity, with network attack vector, high privileges required, and low confidentiality/integrity/availability impact. The stated weakness mappings are CWE-287 and CWE-863.

Defensive priority

Medium for affected Neo4j Enterprise deployments that use multiple OIDC providers or mixed authentication/authorization plugins; lower priority elsewhere because the issue requires specific configuration and elevated administrative context.

Recommended defensive actions

• Upgrade Neo4j Enterprise to 2026.02 or 5.26.22, as recommended by Neo4j.
• Review SSO configurations that use multiple OIDC providers to confirm which providers are intended to handle authentication versus authorization.
• Audit identity-provider group mappings and privilege assignments for any authentication-only provider that could carry higher-privilege groups.
• Validate that authorization decisions are coming from the intended provider after upgrading or reconfiguring.
• Monitor the Neo4j security advisory and NVD record for any updates to affected versions or guidance.

Evidence notes

All material claims are taken from the supplied Neo4j security reference and the NVD CVE record. The CVE was published on 2026-03-11 and modified on 2026-03-12. The source corpus identifies the product as Neo4j Enterprise edition and recommends upgrading to 2026.02 or 5.26.22. The NVD record is still marked "Undergoing Analysis," and the vendor field in the source corpus is low-confidence/needs review, so product attribution should be treated as advisory-backed rather than inferred from the generic vendor metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.