Vendor

n8n

Vulnerabilities in n8n, the open-source workflow automation platform — including Enterprise-only auth, token-exchange, and OEM-integration flaws that surface as CVEs against multi-issuer SSO deployments.

CVEs

CVE-2026-59208

[ MEDIUM ] CVSS 6.8 patched

n8n cross-issuer token exchange authentication bypass

n8n Enterprise instances with two or more trusted JWT issuers matched incoming tokens on `sub` alone, letting a valid token from one issuer log in as a same-`sub` user under another. Fixed in 2.27.4 and 2.28.1.

n8n / n8n (versions below 2.27.4 and 2.28.0 on Enterprise multi-issuer token exchange) Jul 9

Articles

~/articles/2026-07-17-n8n-cve-2026-59208-cross-issuer-token-exchange-sub-iss

n8n

n8n cross-issuer JWT bypass logs attackers in as anyone

CVE-2026-59208: n8n Enterprise instances trusting two or more JWT issuers matched incoming tokens on `sub` alone, letting a token from issuer A log in as B's user.

Jul 17 read →