Executive brief
n8n is a workflow automation platform that allows users to create and share credentials for connecting to external services. An authenticated attacker with credential creation permissions can craft a malicious OAuth2 credential with a JavaScript URL in the authorization field, causing the injected script to execute in the browser of any user who views and interacts with that credential. This could lead to session hijacking, data theft, or unauthorized actions performed on behalf of the victim.
Technical details
This is a Cross-Site Scripting (XSS) vulnerability in the credential management interface of n8n. An authenticated user with credential creation and sharing permissions can inject malicious JavaScript code into the Authorization URL field of an OAuth2 credential. The vulnerability requires the victim to open the credential details and interact with the OAuth authorization button for the attack to succeed. When triggered, the injected script executes in the victim's browser context with their privileges and session cookies, allowing attackers to steal sensitive data, perform actions on behalf of the user, or compromise the n8n instance. The vulnerability has been fixed in n8n versions 2.8.0 and 2.6.4, and users should upgrade immediately.
Affected products
- n8n n8n < 2.8.0 and < 2.6.4
Timeline
- 2026-03-27: disclosed
- 2026-03-27: patched: Fixed in versions 2.8.0 and 2.6.4