An edgecase in the SSO implementation of Neo4j Enterprise Edition allows an administrator to inadvertently grant both authentication and authorization capabilities to an OIDC provider that was intended to provide only authentication. When at least one provider is configured as an authorization provider and at least one as authentication‑only, the authentication‑only provider may also provide authorization. If that provider contains groups with higher privileges than the configured authorization provider, members of those groups can gain unintended, elevated access. This flaw is linked to CWE‑287 (Authentication) and CWE‑863 (Authorization Bypass through Authorization Mechanism). The result is a breach of confidentiality and integrity through unauthorized privilege escalation.

Neo4j Enterprise Edition installations that have two or more OIDC providers enabled and are running versions prior to 2026.02 (or 5.26.22). The vulnerability manifests only when one provider is set for authorization and another for authentication‑only, and the authentication‑only provider contains higher‑privilege groups.

The CVSS score is 2.1, indicating low severity, and the EPSS score is less than 1%, reflecting a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the presence of misconfigured OIDC providers, meaning it is most likely local or administrative in nature rather than remotely exploitable. While the risk level is low, the impact of privilege escalation warrants attention and prompt remediation.