Executive brief
n8n is a workflow automation platform that allows users to log in and access automation workflows. An open redirect vulnerability in the login flow allows attackers to craft malicious URLs that redirect authenticated users to attacker-controlled domains after sign-in. This enables phishing attacks where users may be tricked into entering credentials or two-factor authentication codes on lookalike domains, or lead to reputational harm through domain spoofing.
Technical details
This is a CWE-601 open redirect vulnerability in n8n's /signin endpoint. The vulnerability exists in the client-side redirection logic following user authentication. Attackers can craft malicious URLs with a redirect query parameter that includes the legitimate origin domain as a subdomain of an attacker-controlled domain (e.g., redirect to https://n8n.local.evil.com by exploiting the origin https://n8n.local). The attack requires user interaction—the authenticated user must follow a crafted link—but requires no special privileges beyond an active login session. The fix, released in version 1.98.0, implements strict origin validation for redirect URLs, allowing only same-origin redirects or relative paths. The patch was committed on June 5, 2025 (PR #16034).
Affected products
- n8n n8n < 1.98.0
Timeline
- 2025-06-26: disclosed: Vulnerability disclosed in GHSA-5vj6-wjr7-5v9f
- 2025-06-11: patched: Fix released in version 1.98.0
- 2025-06-05: other: Patch commit merged (PR #16034)