n8n Authentication Flaw Risks Hijacking

Workflow automation platform n8n faced a security vulnerability that allowed users to log into accounts belonging to others. The issue stemmed from the platform’s handling of authentication tokens on Enterprise instances that were configured to trust multiple external identity providers.

Flawed Identity Verification Logic

The core of the issue, tracked as CVE-2026-59208, involved the platform's failure to properly validate identity claims. When processing tokens via the platform's token-exchange flow, the system relied exclusively on the "sub" (subject) claim to identify users. By failing to verify the "iss" (issuer) claim alongside the subject, the system incorrectly matched incoming tokens to local accounts if the subject strings overlapped across different trusted providers.

Because the "sub" value is only guaranteed to be unique within its specific issuer, relying on it in isolation created a significant security blind spot. This implementation, intended to align with RFC 8693 standards, effectively allowed a user authenticated through one issuer to impersonate a user under a different, trusted issuer if their identifiers matched.

Scope of the Vulnerability

The vulnerability is highly specific to enterprise environments. It only impacts instances where the token exchange feature is enabled and where the configuration includes more than one trusted external issuer. As a feature designed primarily for OEM partners who embed the platform, the total number of exposed deployments is limited. However, for organizations using this multi-issuer setup, the risk of account takeover was substantial.

• CVE-2026-59208: The identifier assigned to this identity-binding flaw.
• 7.6: The severity score assigned to the bug on the CVSS 4.0 scale by GitHub.
• 6.8: The severity score assigned to the same vulnerability on the CVSS 3.1 scale by NVD.
• 2.27.4: The version in which the initial fix for this vulnerability was implemented.

Patching and Mitigation

The maintenance team released fixes for the flaw on June 24, 2026. The patches are included in versions 2.27.4 and 2.28.1. Because release notes for these versions focused on other functional updates, such as Python import changes and node upgrades, administrators relying solely on changelogs might have missed the security update. The company advises that for environments where immediate patching is not feasible, the primary mitigation is to restrict trust to a single issuer or disable the token exchange feature entirely.

Implications for Enterprise Users

This incident illustrates the risks associated with complex authentication workflows in Enterprise software. When platforms implement features like token exchange to streamline access for embedded integrations, the integration of multiple identity sources significantly increases the complexity of trust verification. Organizations should treat features labeled as preview with heightened caution and maintain awareness that security-critical fixes may occasionally be bundled into general-purpose updates without explicit mention in standard release documentation. Relying on formal security advisories rather than general changelogs remains essential for identifying these high-stakes configuration risks.