Junglewise Threat Intelligence

CVE-2026-86084: n8n authentication bypass via disabled OIDC SSO endpoints

CVE-2026-86084 · Severity: medium · CVSS 6 · Published 2026-09-10

Executive brief

n8n is a workflow automation platform used by enterprises to build and run integrations. This vulnerability allows attackers to bypass authentication controls in n8n Enterprise instances by exploiting OIDC login endpoints that remain functional even after administrators disable OIDC sign-on. An attacker can log in and obtain valid sessions without authorization, gaining complete access to the target instance and all workflows, credentials, and data it manages.

Technical details

The vulnerability is an authentication bypass (CWE-288) affecting n8n Enterprise where public OIDC (OpenID Connect) login and callback endpoints execute their full authentication flow regardless of whether OIDC is the currently-enabled authentication method. When administrators disable OIDC in the Settings interface, the endpoints fail to validate that OIDC is active before processing login requests and issuing sessions. An attacker with network access to the OIDC endpoints can complete the OIDC flow using a previously-configured identity provider to obtain valid authentication sessions. The vulnerability requires an existing OIDC provider configuration (present at least once in the instance's history) and presents a network-based attack vector requiring low privileges. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2, which add proper validation to enforce that OIDC must be the active authentication method before the endpoints process any flow.

Affected products

  • n8n n8n Enterprise < 1.123.76; >= 2.0.0 and < 2.37.7; >= 2.38.0 and < 2.38.2

Timeline

  • 2026-09-02: disclosed
  • 2026-09-02: patched: Patches released in versions 1.123.76, 2.37.7, and 2.38.2

References

Related threats