Executive brief
n8n is a workflow automation tool used to connect various business applications. A security flaw in how it handles external logins allows an attacker to hijack a user's account if the system is configured to trust multiple login providers. By presenting a valid login token from one provider that shares an ID with a user on another provider, the attacker can gain full access to the victim's account and data.
Technical details
n8n suffers from an improper authentication vulnerability (CWE-287) in its token exchange feature. When multiple trusted external issuers are configured, the application resolves identities to local accounts using only the JWT 'sub' (subject) claim while ignoring the 'iss' (issuer) claim. An attacker with a valid token from one trusted issuer can authenticate as a victim registered under a different issuer if their subject IDs match. This allows for cross-issuer account binding and unauthorized access. The issue is fixed in versions 2.27.4 and 2.28.1.
Affected products
- n8n-io n8n >= 2.28.0, < 2.28.1; < 2.27.4
Timeline
- 2026-06-24: disclosed
- 2026-07-09: advisory: NVD publication
- 2026-07-22: patched: GitHub Advisory published/reviewed