Which versions of n8n are affected by CVE-2026-59208?

A high-severity authentication bypass in n8n (versions before 2.27.4 and 2.28.0) enables account takeover in organizations using multiple federated identity providers, with no public exploit…. A patch is available.

How to fix or mitigate CVE-2026-59208?

Within 24 hours: audit your n8n SSO configuration to identify if multiple identity issuers are trusted; if yes, escalate to incident response and immediately restrict to single issuer or implement compensating controls. Within 7 days: deploy issuer claim validation in identity resolution logic and enable detailed authentication event logging to detect anomalous access. Within 30 days: monitor vendor advisories for availability of patched n8n versions and plan deployment within 30 days of release.

n8n CVE-2026-59208

Q: What is the CVSS score of CVE-2026-59208?

CVE-2026-59208 has a CVSS 4.0 base score of 7.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-42610 HIGH

Improper Authentication (CWE-287)

2026-07-09 GitHub_M

GHSA-mq3m-f8x3-579w

Authentication Bypass Microsoft N8n N8N Io

7.6

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Network-reachable but requires a valid trusted-issuer token (PR:L) plus a non-default multi-issuer config and a cross-issuer sub collision (AC:H); account takeover yields C:H/I:H, no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 17:01 EUVD

Analysis Generated

Jul 09, 2026 - 16:22 vuln.today

CVE Published

Jul 09, 2026 - 15:27 cve.org

HIGH 7.6

DescriptionCVE.org

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

AnalysisAI

Authentication bypass in n8n's external identity resolution lets an attacker impersonate other users when the instance trusts more than one token-exchange issuer. Affecting n8n before 2.27.4 and version 2.28.0, the flaw stems from resolving federated identities using only the JWT sub claim while ignoring the iss claim, so a valid token from one trusted issuer whose sub matches a victim registered under a different issuer grants full access to that victim's account. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the authentication-level impact (VC:H/VI:H) makes it a meaningful account-takeover risk for multi-issuer SSO deployments.

Technical ContextAI

n8n is an open-source, fair-code workflow automation platform (product cpe:2.3:a:n8n-io:n8n) that supports federated login via token exchange with external OIDC/JWT issuers. The defect is a classic CWE-287 (Improper Authentication): when mapping an externally-asserted identity to a local n8n account, the code keyed the lookup solely on the token's sub (subject) identifier and did not scope that lookup by the iss (issuer) claim. Because sub values are only guaranteed unique within a single issuer's namespace - not globally across issuers - two distinct users at two different trusted issuers can share the same sub string, and n8n collapsed them onto the same local account. The bug only manifests when an operator has configured n8n with more than one trusted token-exchange issuer.

RemediationAI

Vendor-released patch: upgrade to n8n 2.27.4 (for the 2.27.x and earlier branch) or 2.28.1 (for the 2.28.x branch), which fix identity resolution to scope lookups by both the iss and sub claims; see the advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-mq3m-f8x3-579w and release notes at https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4 and https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1. If you cannot patch immediately, the most direct compensating control is to reduce the trusted token-exchange configuration to a single issuer, since the flaw only triggers with more than one trusted issuer - the trade-off is loss of any legitimate second-issuer federation until you upgrade. Where multiple issuers are mandatory, restrict and monitor which principals can obtain trusted tokens and audit accounts whose sub identifiers overlap across issuers, accepting that this is detection/containment rather than a true fix.