# CVE-2026-86084: n8n authentication bypass via disabled OIDC SSO endpoints

Source: https://junglewise.ai/threats/cve-2026-86084-n8n-authentication-bypass-via-disabled-oidc-sso-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-86084 · Severity: medium · CVSS 5.5 · Published 2026-09-08

n8n is a workflow automation platform used by enterprises to build and run integrations. This vulnerability allows attackers to bypass authentication controls in n8n Enterprise instances by exploiting OIDC login endpoints that remain functional even after administrators disable OIDC sign-on. An attacker can log in and obtain valid sessions without authorization, gaining complete access to the target instance and all workflows, credentials, and data it manages.

Technologies: [N8n](https://junglewise.ai/threats/technologies/n8n), [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n). Vendors: [N8n](https://junglewise.ai/threats/vendors/n8n), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-86084 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86084 being exploited in the wild.

**How severe is CVE-2026-86084?** Medium severity, with a CVSS score of 5.5, published 8 September 2026.

**Which products and versions are affected?** N8n < 1.123.76; >= 2.0.0 and < 2.37.7; >= 2.38.0 and < 2.38.2; n8n (npm) SEMVER:introduced=0,fixed=1.123.76.

**Is there a fix for CVE-2026-86084?** Yes. n8n (npm): upgrade to 1.123.76 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-86084 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-86084?** Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- n8n (npm): upgrade to 1.123.76 or later

  ```sh
  npm install n8n@1.123.76
  ```


## Technical details

The vulnerability is an authentication bypass (CWE-288) affecting n8n Enterprise where public OIDC (OpenID Connect) login and callback endpoints execute their full authentication flow regardless of whether OIDC is the currently-enabled authentication method. When administrators disable OIDC in the Settings interface, the endpoints fail to validate that OIDC is active before processing login requests and issuing sessions. An attacker with network access to the OIDC endpoints can complete the OIDC flow using a previously-configured identity provider to obtain valid authentication sessions. The vulnerability requires an existing OIDC provider configuration (present at least once in the instance's history) and presents a network-based attack vector requiring low privileges. Patches are available in versions 1.123.76, 2.37.7, and 2.38.2, which add proper validation to enforce that OIDC must be the active authentication method before the endpoints process any flow.

## Affected products

- n8n n8n Enterprise < 1.123.76; >= 2.0.0 and < 2.37.7; >= 2.38.0 and < 2.38.2

## Identifiers

- CVE-2026-86084
- GHSA-pf83-w3f9-8m37

## Timeline

- 2026-09-02: disclosed
- 2026-09-02: patched: Patches released in versions 1.123.76, 2.37.7, and 2.38.2

## References

- [https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37](https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76](https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7](https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2](https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2)
- [https://api.github.com/repos/n8n-io/n8n/security-advisories/GHSA-pf83-w3f9-8m37](https://api.github.com/repos/n8n-io/n8n/security-advisories/GHSA-pf83-w3f9-8m37)

## Related threats

- [n8n path traversal in Databricks node](https://junglewise.ai/threats/cve-2026-119557-n8n-from-2-14-0-through-2-46-3-contains-a-path-traversal)
- [n8n remote code execution in deprecated Function nodes](https://junglewise.ai/threats/cve-2026-119408-n8n-before-2-42-6-2-43-x-before-2-43-3-and-3-x-before-3-0-1)
- [n8n Slack Trigger SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-118679-n8n-before-1-123-83-2-41-4-and-2-42-1-contains-a-server-side)
- [n8n prototype pollution in workflow history compaction](https://junglewise.ai/threats/cve-2026-118678-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-prototype)
- [n8n Local Gateway deep-link missing confirmation re-pairing](https://junglewise.ai/threats/cve-2026-118677-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-missing)