EUVD-2026-56098
GHSA-cwxf-925x-2ccm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No n8n privileges required (PR:N) since the external token is the credential; AC:H reflects non-default embed login configuration plus requirement to obtain a valid issuer token; S:C because attacker accesses a different account's scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
AnalysisAI
Account takeover in n8n before 2.32.1 (and before 2.31.5 in the prior release line) is enabled by two simultaneous omissions in the Token Exchange Embed Login feature: the platform accepts an incoming JWT's email claim without confirming the issuer has cryptographically verified that address, and it does not enforce the trusted key's configured role ceiling against the matched local account. An attacker able to obtain any validly-signed token from a configured trusted issuer - including issuers that routinely emit unverified email addresses as part of their standard flows - can present that token with a victim user's email and be granted a fully authenticated n8n session with complete account control. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default configuration conditions to be simultaneously active: (1) the embed login feature must be explicitly enabled via the N8N_TOKEN_EXCHANGE_ENABLED environment variable, which is disabled by default, and (2) at least one trusted key source must be configured in the instance. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.9 with full High impact across confidentiality, integrity, and availability on both the vulnerable and subsequent systems accurately reflects worst-case outcomes when preconditions are satisfied, but the AT:P (specific attack requirements present) metric is the pivotal signal: exploitation is gated on the embed login feature being explicitly enabled via N8N_TOKEN_EXCHANGE_ENABLED and at least one trusted key source being configured - neither of which is a default state. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The vendor-released patch is n8n 2.32.1 (or 2.31.5 for the prior release line), incorporating fix commit f69dfc6dd2178a14ea1624d2e1d403c2e755042f; upgrade is the only complete remediation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit your n8n deployment configuration to confirm whether Token Exchange Embed Login with trusted issuer integration is in use; if enabled, assess the risk posture of connected integrations and document which users or workflows could be targeted. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
The n8n package 0.218.0 for Node.js allows Directory Traversal. Rated medium severity (CVSS 6.5), this vulnerability is
n8n versions prior to 2.5.0 contain a critical SSH host key verification bypass in the Source Control feature that allow
This vulnerability in n8n (an open-source workflow automation platform) is an authentication bypass in the OAuth callbac
Code injection in n8n workflow automation before 2.10.1/2.9.3/1.123.22 allows authenticated users to execute arbitrary c
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today