Executive brief
n8n is a workflow automation platform that allows users to connect applications and automate repetitive tasks. This vulnerability allows attackers to take over any user account on instances with embed login enabled, by exploiting inadequate validation of email claims during token-based authentication. An attacker can gain complete control of accounts, including administrative accounts, if they can obtain a token from a trusted authentication provider that doesn't properly verify email addresses.
Technical details
This is an authentication bypass and privilege escalation vulnerability in n8n's embed login token exchange feature. The root cause is that when a validly-signed incoming token is matched to a local account by its email claim, the service fails to verify: (1) that the email claim itself is verified, and (2) that the trusted key's permitted role ceiling covers the target account. An attacker who obtains a token from any configured trusted key source—particularly those emitting unverified email addresses—can authenticate as any existing user. The attack requires network access to the n8n instance and valid signed token from a trusted issuer, but no prior authentication. The vulnerability is fixed in versions 2.31.5 and 2.32.1 or later.
Affected products
- n8n n8n < 2.31.5, 2.32.0
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Fixed in versions 2.31.5 and 2.32.1