CVE-2026-59208CWE-287CWE-346

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

High · published July 9, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00265 · 17.4th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-346 · Origin Validation Error
Published
2026-07-09T15:27Z
EPSS history
Timeline
  • 09 JUL 15:27Z
    n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
    cvelistv5