Executive brief
n8n is an open-source workflow automation platform that connects applications and services. When a specific environment variable (N8N_SKIP_AUTH_ON_OAUTH_CALLBACK) is enabled—a non-default configuration—an attacker can trick users into authorizing OAuth connections to attacker-controlled credentials, allowing the attacker to steal and misuse the victim's authentication tokens to execute workflows on their behalf. This risks unauthorized access to integrated services and data.
Technical details
The vulnerability is an authorization bypass (CWE-863) in n8n's OAuth callback handler. When N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true, the handler fails to verify ownership of the OAuth state parameter, allowing state confusion attacks. An attacker can craft a malicious OAuth redirect that causes a victim's tokens to be stored in the attacker's credential object. The attack requires user interaction (victim must complete the OAuth flow) and network access to the n8n instance. An authenticated attacker with credential creation privileges can then use the stolen tokens to execute workflows. The vulnerability affects all versions prior to 2.8.0, and a patch is available in v2.8.0 and later.
Affected products
- n8n n8n < 2.8.0
Timeline
- 2026-03-25: disclosed
- 2026: patched: Fixed in version 2.8.0