N8n EUVD-2026-15952

The CVSS v4.0 score of 6.3 reflects a network-accessible vulnerability with low attack complexity and partial temporal factors, indicating moderate severity. However, the CVSS vector details (AV:N/AC:L/AT:P) show that exploitation requires some preparatory work (AT:P - attacker-targeted) and no privileges, making it more feasible than baseline metrics suggest. The real-world risk is substantially mitigated by three factors: First, the vulnerability only affects non-default configurations where N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true is explicitly enabled—a deliberate opt-in setting used in specific deployment scenarios such as reverse-proxy authentication bypass. Second, the vulnerability requires user interaction (UI:N in CVSS indicates no user interaction for the initial attack, but the scenario description indicates the victim must complete an OAuth flow, suggesting social engineering is necessary). Third, a patch has been released in version 2.8.0, and the issue is tracked on GitHub's security advisory system. For organizations running default n8n configurations, risk is negligible; for those with the flag enabled, the risk is elevated but manageable through upgrade or compensating controls.

An attacker creates an n8n instance and initiates an OAuth connection flow for a third-party service (such as Google Drive or GitHub). The attacker crafts a malicious URL containing their own OAuth state parameter and social engineers a victim into clicking the link. When the victim authenticates with the OAuth provider and the callback returns to the victim's n8n instance (which has N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true enabled), the compromised handler skips state validation and stores the victim's OAuth tokens in the attacker's credential object. The attacker can now use those tokens to access the victim's data and execute workflows on behalf of the victim's OAuth account, potentially exfiltrating sensitive information or triggering unintended actions.