{"id":"CVE-2026-126385","kind":"vulnerability","aliases":["CVE-2026-126385"],"related":[],"title":"n8n: OAuth2 callback lets a member store a victim's tokens","description":"n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.","summary":"n8n's OAuth2 credential callback in the dynamic-credential connect flow does not check that the browser completing the flow belongs to the user who started it. A member with access to an OAuth2 credential can send the provider's authorization link to a victim, and if the victim consents without an active n8n session, the victim's tokens are stored under the member's account so the member's workflows act as the victim.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","n8n","oauth2","self-hosted","workflow-automation"],"not_affected_if":["managed-hosting-patched","no-oauth2-credentials","single-user-instance"],"how_to_check":null,"fix":"- n8n `2.45.5` or later on the 2.45 line\n- n8n `2.46.1` or later on the 2.46 line\n- n8n `3.0.1` or later on the 3.x line","status":"open","published_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:52:32+00:00","updated_at":"2026-11-13T10:52:32+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:52:32Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.45.5` or later on the 2.45 line\n- n8n `2.46.1` or later on the 2.46 line\n- n8n `3.0.1` or later on the 3.x line","reach":"internet","title":"n8n: OAuth2 callback lets a member store a victim's tokens","impact":"high","summary":"n8n's OAuth2 credential callback in the dynamic-credential connect flow does not check that the browser completing the flow belongs to the user who started it. A member with access to an OAuth2 credential can send the provider's authorization link to a victim, and if the victim consents without an active n8n session, the victim's tokens are stored under the member's account so the member's workflows act as the victim.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","oauth2","workflow-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"a member's workflows act as a victim using the victim's stored tokens","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the image tag; versions below `2.45.5`, `2.46.0`, and `3.0.0` (the ranges in the sources) are in scope.\n- Look for dynamic OAuth2 credentials in use by workflows that people outside the admin group can edit or connect.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-user-instance","no-oauth2-credentials","managed-hosting-patched"],"who_is_affected":"Teams that self-host n8n or run it on a managed plan, specifically instances that use OAuth2 credentials created through the dynamic-credential connect flow and that let more than one member create or connect credentials. A member needs access to a resolvable OAuth2 credential, and the victim must consent in a browser, so single-user instances without shared OAuth2 credentials face much less risk.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000815,"input_tokens":4685,"output_tokens":693,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-126385':14A,17A '-2026':13A,16A '2.45.5':107C '2.46':108C '2.46.1':111C '3':113C '3.0.1':116C 'access':60B,150C 'account':95B 'act':101B,190C 'activ':82B,171C 'ai':19B 'ai-tool':18B 'author':70B,160C 'autom':28B 'belong':50B,140C 'browser':46B,139C 'callback':3A,33B,124C 'check':43B 'complet':47B,138C 'connect':39B,130C 'consent':79B,168C 'contain':117C 'credenti':32B,38B,64B,123C,129C,155C 'cve':12A,15A 'dynam':37B,128C 'dynamic-credenti':36B,127C 'flaw':119C 'flow':40B,49B,131C,147C 'host':25B 'ident':184C 'let':4A,185C 'link':71B 'member':6A,58B,93B,98B,148C,182C,187C 'n8n':1A,21B,29B,83B,105C,172C 'oauth2':2A,22B,31B,63B,122C,154C 'provid':68B,159C 'resolv':153C 'self':24B 'self-host':23B 'send':66B,157C 'session':84B,173C 'start':55B,145C 'store':7A,90B,179C 'token':11A,88B,177C 'tool':20B 'url':161C 'user':53B,143C 'verifi':135C 'victim':9A,74B,78B,86B,104B,164C,167C,175C,193C 'without':80B,169C 'workflow':27B,100B,189C 'workflow-autom':26B 'x':109C,114C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host n8n or run it on a managed plan, specifically instances that use OAuth2 credentials created through the dynamic-credential connect flow and that let more than one member create or connect credentials. A member needs access to a resolvable OAuth2 credential, and the victim must consent in a browser, so single-user instances without shared OAuth2 credentials face much less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","high","n8n","oauth2","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'-126385':14A,17A '-2026':13A,16A 'callback':3A 'cve':12A,15A 'let':4A 'member':6A 'n8n':1A 'oauth2':2A 'store':7A 'token':11A 'victim':9A","search_b":"'access':60B 'account':95B 'act':101B 'activ':82B 'ai':19B 'ai-tool':18B 'author':70B 'autom':28B 'belong':50B 'browser':46B 'callback':33B 'check':43B 'complet':47B 'connect':39B 'consent':79B 'credenti':32B,38B,64B 'dynam':37B 'dynamic-credenti':36B 'flow':40B,49B 'host':25B 'link':71B 'member':58B,93B,98B 'n8n':21B,29B,83B 'oauth2':22B,31B,63B 'provid':68B 'self':24B 'self-host':23B 'send':66B 'session':84B 'start':55B 'store':90B 'token':88B 'tool':20B 'user':53B 'victim':74B,78B,86B,104B 'without':80B 'workflow':27B,100B 'workflow-autom':26B","search_c":"'2.45.5':107C '2.46':108C '2.46.1':111C '3':113C '3.0.1':116C 'access':150C 'act':190C 'activ':171C 'author':160C 'belong':140C 'browser':139C 'callback':124C 'complet':138C 'connect':130C 'consent':168C 'contain':117C 'credenti':123C,129C,155C 'dynam':128C 'dynamic-credenti':127C 'flaw':119C 'flow':131C,147C 'ident':184C 'let':185C 'member':148C,182C,187C 'n8n':105C,172C 'oauth2':122C,154C 'provid':159C 'resolv':153C 'send':157C 'session':173C 'start':145C 'store':179C 'token':177C 'url':161C 'user':143C 'verifi':135C 'victim':164C,167C,175C,193C 'without':169C 'workflow':189C 'x':109C,114C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126385","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126385","severity":null,"published_at":"2026-11-13T10:17:41+00:00","modified_at":"2026-11-13T10:17:41+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":110631,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:48:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145013,"url":"https://www.vulncheck.com/advisories/n8n-before-2.46.1-oauth-account-hijack-via-unauthenticated-credential-callback","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}