Neo4j Enterprise Excessive Authentication Context Caching Vulnerability

A vulnerability exists in Neo4j Enterprise Edition versions prior to 2026.01.4, where excessive caching of authentication context can lead to authenticated users inheriting the context of the first user who logged in after a restart. This issue is confined to certain non-default SSO configurations that utilize the UserInfo endpoint.

Impact

This vulnerability can result in unauthorized context inheritance, potentially allowing users to gain access to resources or permissions intended for other users.

Remediation

Users are advised to upgrade to Neo4j Enterprise Edition versions 2026.01.4 or 5.26.22, where this issue has been fixed. As a temporary workaround, set 'dbms.security.oidc.<provider>.get_groups_from_user_info' and 'dbms.security.oidc.<provider>.get_username_from_user_info' to 'false'.