CVE-2026-86084: n8n authentication bypass via disabled OIDC SSO endpoints

CVE-2026-86084 · Severity: medium · CVSS 5.5 · Published 2026-09-08

n8n is a workflow automation platform used by enterprises to build and run integrations. This vulnerability allows attackers to bypass authentication controls in n8n Enterprise instances by exploiting OIDC login endpoints that remain functional even after administrators disable OIDC sign-on. An attacker can log in and obtain valid sessions without authorization, gaining complete access to the target instance and all workflows, credentials, and data it manages.

Technologies: N8n, n8n (npm). Vendors: N8n, npm.

Quick answers

Is CVE-2026-86084 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86084 being exploited in the wild.
How severe is CVE-2026-86084?
Medium severity, with a CVSS score of 5.5, published 8 September 2026.
Which products and versions are affected?
N8n < 1.123.76; >= 2.0.0 and < 2.37.7; >= 2.38.0 and < 2.38.2; n8n (npm) SEMVER:introduced=0,fixed=1.123.76.
Is there a fix for CVE-2026-86084?
Yes. n8n (npm): upgrade to 1.123.76 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86084 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86084?
Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n (npm): upgrade to 1.123.76 or later
    npm install n8n@1.123.76

Technical details

The vulnerability is an authentication bypass (CWE-288) affecting n8n Enterprise where public OIDC (OpenID Connect) login and callback endpoints execute their full authentication flow regardless of whether OIDC is the currently-enabled authentication method. When administrators disable OIDC in the Settings interface, the endpoints fail to validate that OIDC is active before processing login requests and issuing sessions. An attacker with network access to the OIDC endpoints can complete the OIDC flow using a previously-configured identity provider to obtain valid authentication sessions. The vulnerability requires an existing OIDC provider configuration (present at least once in the instance's history) and presents a network-based attack vector requiring low privileges. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2, which add proper validation to enforce that OIDC must be the active authentication method before the endpoints process any flow.

Affected products

  • n8n n8n Enterprise < 1.123.76; >= 2.0.0 and < 2.37.7; >= 2.38.0 and < 2.38.2

Identifiers

  • CVE-2026-86084
  • GHSA-pf83-w3f9-8m37

Timeline

  • 2026-09-02: disclosed
  • 2026-09-02: patched: Patches released in versions 1.123.76, 2.37.7, and 2.38.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.