CVE-2026-59208: n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-10-25
Weakness: CWE-287

Description

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim. This issue is fixed in versions 2.27.4 and 2.28.1.

Affected products

n8n-io n8n: before 2.27.4; 2.28.0 — fixed in 2.27.4

How to fix

Upgrade to a fixed version: n8n-io n8n 2.27.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-59208 or the next vulnerability affects your stack