SSO Authentication Bypass: n8n Patches Critical Token-Exchange Security Flaw
Executive Summary
A critical single sign-on (SSO) authentication bypass vulnerability has been disclosed and patched in the n8n workflow automation platform. Tracked as CVE-2026-59208, the flaw carries a CVSS 4.0 severity rating of 7.6 (High) or CVSS 3.1 rating of 6.8 (Medium) depending on the evaluating authority. This critical vulnerability allows unauthorized attackers to bypass authentication entirely and hijack user accounts on n8n Enterprise instances that are configured with more than one trusted token-exchange issuer (such as multi-issuer OEM partner and enterprise environments).
The defect is located within n8n's token-exchange flow—specifically during the identity resolution phase. When an incoming JSON Web Token (JWT) was processed to map an external identity to a local account, n8n relied solely on the token's subject (sub) claim to look up the target user, while failing to cross-verify the token's issuer (iss) claim. As a result, an attacker who controls a trusted identity provider (or a compromised/rogue identity provider) could generate a valid JWT using a victim's sub claim and log in directly to that user's account under a different, completely unrelated trusted identity provider.
Discovered by an automated AI penetration testing agent from Strix Security, n8n has addressed this logical flaw in cumulative updates. To eliminate the risk of cross-issuer account takeover, administrators are urged to immediately update their instances to the latest stable versions of n8n.
Deep-Dive Technical Analysis
Workflow automation engines like n8n act as the central nervous system for modern enterprise environments, connecting critical APIs, database clusters, CI/CD pipelines, and SaaS platforms. To provide seamless authentication for embeddable OEM partners and multi-tenant architectures, n8n Enterprise implements an RFC 8693 token-exchange mechanism. Under normal conditions, this flow enables a trusted partner to sign a short-lived JSON Web Token (JWT) with their private key; n8n verifies the signature against a configured public key, resolves the token claims to a local user account, and logs the user in without requiring an additional password prompt.
However, a detailed technical analysis of CVE-2026-59208 reveals a fundamental logical flaw in how n8n resolves identity mapping in multi-issuer environments:
* The Entry Vector (Multi-Issuer Environments): The vulnerability only impacts n8n deployments that are configured with multiple distinct external identity providers (IdPs) or token-exchange issuers. In a single-issuer setup, user subject (sub) claims are unique, preventing identity conflicts.
* Subject-Only Identity Resolution: When a JWT is submitted to n8n's Token Identity Resolver, the server verifies the cryptographic signature of the token to ensure it was signed by one of the configured trusted keys. Once signature verification succeeds, n8n attempts to map the external identity to a local user account. The critical error occurs here: n8n looked up the local account using only the sub claim and completely ignored the issuer (iss) claim.
* The Logical Bypass (Cross-Issuer Account Takeover): Because the sub claim (often an email address, username, or static user ID) is only unique within the scope of its issuing IdP, different IdPs can issue identical sub claims. An attacker controlling any one of the trusted issuers (or a rogue/compromised partner IdP) can construct a valid, cryptographically signed JWT. By setting the sub claim in that JWT to match the identifier of a high-value victim whose account resides under a different trusted issuer, the attacker can submit the token to n8n.
* Bypassing the Security Gate: n8n's Token Identity Resolver processes the token, confirms it is signed by a trusted issuer (the attacker's IdP), and then locates the victim's local user account matching that sub claim. Because n8n did not verify that the token issuer matched the user's registered issuer, the attacker is logged directly into the victim's account, achieving full administrative control over the victim's automated workflows and connected credentials.
The simplicity and high reliability of this logical bypass made it an attractive target, though there is no public proof-of-concept currently available in the wild.
Industry Impact and Recommendations
Centralized workflow managers are goldmines for threat actors because they store sensitive OAuth tokens, database credentials, and system administration keys. Compromising a single user account on n8n can lead to a massive blast radius across connected cloud infrastructure. By letting an attacker leverage a less-secure or compromised external issuer to hijack a victim's account on a highly secure issuer, CVE-2026-59208 effectively reduces the security of the entire enterprise SSO ecosystem to its weakest link.
To remediate this vulnerability and secure your orchestration environments, we recommend that IT security teams and n8n administrators implement the following mitigations:
1. Apply n8n Security Patches Immediately: The vulnerability affects all n8n versions prior to 2.27.4 and version 2.28.0. The fix has been backported, and n8n has released patches in versions 2.27.4 and 2.28.1. Upgrade your deployments to these floor versions, or ideally to the newest stable release (such as 2.30.6 or later).
2. Minimize the Trusted Issuer List: Audit the N8N_TOKEN_EXCHANGE_TRUSTED_KEYS environment variable and your n8n SSO configurations. Cut back to a single trusted issuer wherever possible, or completely disable token exchange if it is not actively required for your business operations.
3. Enforce Continuous Monitoring on Authentication Logs: Configure your SIEM or centralized logging solutions to flag suspicious SSO login patterns. Specifically, monitor for logins where the incoming token issuer (iss) does not match the historical or registered issuer profile of the authenticating user account.
4. Implement Defense-in-Depth for Workspace Secrets: Ensure that sensitive third-party credentials used in n8n workflows are stored securely (e.g., using external secrets managers) and that workflow access controls are audited regularly to limit the blast radius of a compromised account.
References:
* The Hacker News — n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
* NVD — CVE-2026-59208 Detail
* Offseq Threat Advisory — CVE-2026-59208
* VulDB — CVE-2026-59208 Analysis