CVE-2026-59208 PUBLISHED

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

Assigner: GitHub_M
Reserved: 02.07.2026 Published: 09.07.2026 Updated: 09.07.2026

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.6

Product Status

Vendor n8n-io
Product n8n
Versions
  • Version >= 2.28.0, < 2.28.1 is affected
  • Version < 2.27.4 is affected

References

Problem Types

  • CWE-287: Improper Authentication CWE
  • CWE-346: Origin Validation Error CWE