CVE-2026-56350CWE-285

n8n - SSO Enforcement Bypass via API

Medium · published June 30, 2026

CVSS v4.0
6.0
EPSS
0%
Percentile
30.7
In the wild
Unconfirmed
What it is

n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.

The record
Technical detail
CVSS v4.0
6.0 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00379 · 30.7th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-06-30T22:08Z
EPSS history
Timeline
  • 30 JUN 22:08Z
    n8n - SSO Enforcement Bypass via API
    cvelistv5