CVE-2026-56359CWE-79

n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL

Medium · published July 8, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-08T13:49Z
EPSS history
Timeline
  • 08 JUL 13:49Z
    n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL
    cvelistv5