N8N · GHSA-426f-xmcv-g8pg · AI agents & MCP
FIX → >= 2.46.1 +2
n8n's dynamic OAuth2 credential connect flow did not check that the browser completing consent belonged to the user who started it. An attacker with editor access can send the authorization link to someone else, and that person's OAuth tokens get stored where the attacker's workflows can use them as the victim.
first public Oct 28, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Enterprise n8n instances with resolvable OAuth2 credentials are affected, and the attacker needs editor access to a team project. Instances on the fixed versions, instances without Enterprise OAuth2 credentials, and instances with dynamic credentials disabled are not exposed through this flaw.
Not affected if default-config, dynamic-credentials-disabled, no-resolvable-oauth2-credentials
Who cares enterprise, n8n, oauth, self-hosted
n8n --version or the npm ls n8n output.N8N_OAUTH_BROWSER_BINDING environment variable is set to true.The OAuth2 credential callback did not require the browser completing the dynamic-credential connect flow to be authenticated as the user who started it. A member with access to a resolvable OAuth2 credential could send the provider authorization URL to another person. If that person completed the consent without an active n8n session, their provider tokens were stored under the member's identity, and the member's workflows could then act as the victim at the OAuth provider.
This affects Enterprise instances with resolvable OAuth2 credentials configured.
The issue has been fixed in n8n versions 2.46.1, 2.45.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
N8N_OAUTH_BROWSER_BINDING=true to enforce browser-session binding on OAuth callbacks.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to >= 2.46.1 +2
2.46.1 for the 2.46 line2.45.5 for the 2.45 line3.0.1 for the 3.x lineN8N_OAUTH_BROWSER_BINDING=true, but it does not fully remediate the risk.