{"id":"GHSA-426f-xmcv-g8pg","kind":"vulnerability","aliases":["GHSA-426f-xmcv-g8pg"],"related":[],"title":"OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback","description":"## Impact\n\nThe OAuth2 credential callback did not require the browser completing the dynamic-credential connect flow to be authenticated as the user who started it. A member with access to a resolvable OAuth2 credential could send the provider authorization URL to another person. If that person completed the consent without an active n8n session, their provider tokens were stored under the member's identity, and the member's workflows could then act as the victim at the OAuth provider.\n\nThis affects Enterprise instances with resolvable OAuth2 credentials configured.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.46.1, 2.45.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Set `N8N_OAUTH_BROWSER_BINDING=true` to enforce browser-session binding on OAuth callbacks.\n- Restrict n8n instance access to fully trusted users only.\n- Audit team project memberships and remove editor access from any users who are not fully trusted.\n- Disable the dynamic credentials feature if it is not required.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"n8n's dynamic OAuth2 credential connect flow did not check that the browser completing consent belonged to the user who started it. An attacker with editor access can send the authorization link to someone else, and that person's OAuth tokens get stored where the attacker's workflows can use them as the victim.","severity":"medium","cvss":4.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","enterprise","n8n","oauth","self-hosted"],"not_affected_if":["default-config","dynamic-credentials-disabled","no-resolvable-oauth2-credentials"],"how_to_check":"- Check the installed n8n version with `n8n --version` or the `npm ls n8n` output.\n- Confirm whether Enterprise resolvable OAuth2 credentials are configured in n8n.\n- Check whether the `N8N_OAUTH_BROWSER_BINDING` environment variable is set to `true`.","fix":"- n8n `2.46.1` for the 2.46 line\n- n8n `2.45.5` for the 2.45 line\n- n8n `3.0.1` for the 3.x line\n- Until upgrading, the advisory suggests setting `N8N_OAUTH_BROWSER_BINDING=true`, but it does not fully remediate the risk.","status":"open","published_at":"2026-10-28T08:48:31+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:57:07+00:00","updated_at":"2026-11-09T22:57:07+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:57:07Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `2.46.1` for the 2.46 line\n- n8n `2.45.5` for the 2.45 line\n- n8n `3.0.1` for the 3.x line\n- Until upgrading, the advisory suggests setting `N8N_OAUTH_BROWSER_BINDING=true`, but it does not fully remediate the risk.","reach":"internet","title":"n8n: OAuth callback lets a victim's provider tokens land under a member's account","impact":"medium","summary":"n8n's dynamic OAuth2 credential connect flow did not check that the browser completing consent belonged to the user who started it. An attacker with editor access can send the authorization link to someone else, and that person's OAuth tokens get stored where the attacker's workflows can use them as the victim.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","oauth","enterprise"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"victim OAuth tokens usable by member's workflows at provider","analyst_note":"","how_to_check":"- Check the installed n8n version with `n8n --version` or the `npm ls n8n` output.\n- Confirm whether Enterprise resolvable OAuth2 credentials are configured in n8n.\n- Check whether the `N8N_OAUTH_BROWSER_BINDING` environment variable is set to `true`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","no-resolvable-oauth2-credentials","dynamic-credentials-disabled"],"who_is_affected":"Only Enterprise n8n instances with resolvable OAuth2 credentials are affected, and the attacker needs editor access to a team project. Instances on the fixed versions, instances without Enterprise OAuth2 credentials, and instances with dynamic credentials disabled are not exposed through this flaw.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00085,"input_tokens":5000,"output_tokens":700,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'2.45.5':190C '2.46.1':189C '3.0.1':192C '426f':17A,22A 'access':63B,120C,239C,252C 'account':2A 'act':163C 'activ':143C 'administr':214C 'affect':172C 'ai':29B 'ai-tool':28B 'anoth':133C 'attack':60B,82B 'audit':245C 'authent':110C 'author':67B,130C 'belong':52B 'bind':225C,232C 'browser':49B,100C,224C,230C 'browser-sess':229C 'callback':14A,95C,235C 'check':46B 'complet':50B,101C,138C 'configur':179C 'connect':10A,42B,106C 'consent':51B,140C 'consid':216C 'could':126C,161C 'credenti':9A,41B,94C,105C,125C,178C,264C 'disabl':261C 'dynam':39B,104C,263C 'dynamic-credenti':103C 'editor':62B,251C 'els':71B 'end':7A 'end-us':6A 'enforc':228C 'enterpris':31B,173C 'featur':265C 'fix':185C 'flow':11A,43B,107C 'follow':218C 'fulli':241C,259C,275C 'g8pg':19A,24A 'get':78B 'ghsa':16A,21A 'ghsa-426f-xmcv-g8pg':15A,20A 'hijack':3A 'host':36B 'ident':155C 'immedi':212C 'impact':91C 'instanc':174C,238C 'issu':182C 'later':202C 'link':68B 'measur':289C 'member':118C,153C,158C 'membership':248C 'mitig':220C,288C 'n8n':25A,26A,27A,32B,37B,144C,187C,222C,237C 'oauth':1A,33B,76B,169C,223C,234C 'oauth2':40B,93C,124C,177C 'one':197C 'patch':180C 'person':74B,134C,137C 'possibl':213C 'project':247C 'provid':129C,147C,170C 'remedi':204C,276C 'remov':250C 'requir':98C,270C 'resolv':123C,176C 'restrict':236C 'risk':278C 'self':35B 'self-host':34B 'send':65B,127C 'session':145C,231C 'set':221C 'short':286C 'short-term':285C 'someon':70B 'start':57B,115C 'store':79B,150C 'team':246C 'temporari':219C 'term':287C 'token':77B,148C 'tool':30B 'true':226C 'trust':242C,260C 'unauthent':13A 'upgrad':195C,209C 'url':131C 'use':86B,283C 'user':8A,55B,113C,193C,243C,255C 'version':188C,200C 'via':12A 'victim':90B,166C 'vulner':206C 'without':141C 'workaround':207C,272C 'workflow':84B,160C 'xmcv':18A,23A","nicknames":[],"mitigations":[],"who_affected":"Only Enterprise n8n instances with resolvable OAuth2 credentials are affected, and the attacker needs editor access to a team project. Instances on the fixed versions, instances without Enterprise OAuth2 credentials, and instances with dynamic credentials disabled are not exposed through this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","enterprise","medium","n8n","npm","oauth","selfhosted"],"campaign_type":null,"search_a":"'426f':17A,22A 'account':2A 'callback':14A 'connect':10A 'credenti':9A 'end':7A 'end-us':6A 'flow':11A 'g8pg':19A,24A 'ghsa':16A,21A 'ghsa-426f-xmcv-g8pg':15A,20A 'hijack':3A 'n8n':25A,26A,27A 'oauth':1A 'unauthent':13A 'user':8A 'via':12A 'xmcv':18A,23A","search_b":"'access':63B 'ai':29B 'ai-tool':28B 'attack':60B,82B 'author':67B 'belong':52B 'browser':49B 'check':46B 'complet':50B 'connect':42B 'consent':51B 'credenti':41B 'dynam':39B 'editor':62B 'els':71B 'enterpris':31B 'flow':43B 'get':78B 'host':36B 'link':68B 'n8n':32B,37B 'oauth':33B,76B 'oauth2':40B 'person':74B 'self':35B 'self-host':34B 'send':65B 'someon':70B 'start':57B 'store':79B 'token':77B 'tool':30B 'use':86B 'user':55B 'victim':90B 'workflow':84B","search_c":"'2.45.5':190C '2.46.1':189C '3.0.1':192C 'access':120C,239C,252C 'act':163C 'activ':143C 'administr':214C 'affect':172C 'anoth':133C 'audit':245C 'authent':110C 'author':130C 'bind':225C,232C 'browser':100C,224C,230C 'browser-sess':229C 'callback':95C,235C 'complet':101C,138C 'configur':179C 'connect':106C 'consent':140C 'consid':216C 'could':126C,161C 'credenti':94C,105C,125C,178C,264C 'disabl':261C 'dynam':104C,263C 'dynamic-credenti':103C 'editor':251C 'enforc':228C 'enterpris':173C 'featur':265C 'fix':185C 'flow':107C 'follow':218C 'fulli':241C,259C,275C 'ident':155C 'immedi':212C 'impact':91C 'instanc':174C,238C 'issu':182C 'later':202C 'measur':289C 'member':118C,153C,158C 'membership':248C 'mitig':220C,288C 'n8n':144C,187C,222C,237C 'oauth':169C,223C,234C 'oauth2':93C,124C,177C 'one':197C 'patch':180C 'person':134C,137C 'possibl':213C 'project':247C 'provid':129C,147C,170C 'remedi':204C,276C 'remov':250C 'requir':98C,270C 'resolv':123C,176C 'restrict':236C 'risk':278C 'send':127C 'session':145C,231C 'set':221C 'short':286C 'short-term':285C 'start':115C 'store':150C 'team':246C 'temporari':219C 'term':287C 'token':148C 'true':226C 'trust':242C,260C 'upgrad':195C,209C 'url':131C 'use':283C 'user':113C,193C,243C,255C 'version':188C,200C 'victim':166C 'vulner':206C 'without':141C 'workaround':207C,272C 'workflow':160C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-426f-xmcv-g8pg","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","severity":"medium","published_at":"2026-10-28T08:48:31+00:00","modified_at":"2026-10-28T08:48:31+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110631,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}