https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 08:40:51 +0000 https://cve.radiocsirt.org/vuln/bit-neo4j-2026-1524 <p><strong>Affected:</strong> Bitnami: neo4j</p> <p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:</p> <p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.</p> <p>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.</p> <p>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p> <p><strong>Affected:</strong> Bitnami: neo4j</p> <p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:</p> <p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.</p> <p>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.</p> <p>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p> https://cve.radiocsirt.org/vuln/bit-neo4j-2026-1524 https://cve.radiocsirt.org/vuln/euvd-2026-275803 EUVD-2026-275803 https://cve.radiocsirt.org/vuln/euvd-2026-275803 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1524 <p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:</p> <p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.</p> <p>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.</p> <p>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p> <p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:</p> <p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.</p> <p>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.</p> <p>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1524 https://cve.radiocsirt.org/vuln/ghsa-5pgp-mc2w-hjjx <p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:</p> <p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.</p> <p>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.</p> <p>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p> <p>An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:</p> <p>If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.</p> <p>When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities.</p> <p>We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.</p> https://cve.radiocsirt.org/vuln/ghsa-5pgp-mc2w-hjjx