{"id":"GHSA-rc3w-8jc8-7x3w","kind":"vulnerability","aliases":["GHSA-rc3w-8jc8-7x3w"],"related":[],"title":"Open Redirect via MCP OAuth Dynamic Client Registration","description":"## Impact\n\nThe MCP OAuth registration and authorization endpoints are enabled by default and require no authentication. Any caller could register an OAuth client with an arbitrary `redirect_uri`, and a crafted authorization URL then redirected the visitor to that URI before the instance's checks ran, turning the n8n instance into an open redirector. No tokens or session data were included in the redirect. A victim had to open the crafted URL.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Apply network-level controls or a reverse-proxy rule to block unauthenticated access to the `/mcp-oauth/register` and `/mcp-oauth/authorize` endpoints.\n- Educate users not to follow unsolicited links pointing to your n8n instance's OAuth endpoints.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"n8n's MCP OAuth registration and authorization endpoints are enabled by default and need no login, so anyone can register a client with an arbitrary redirect URI. A victim who opens a crafted authorization link is sent on to that attacker-chosen address, turning the instance into an open redirector; no tokens or session data are included in the redirect.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 1.123.89"],"affected":"< 1.123.89","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","mcp","n8n","self-hosted"],"not_affected_if":["endpoints-blocked-at-proxy","patched-version"],"how_to_check":"- Check the n8n version with `n8n --version` or the npm package version; affected builds are below `1.123.89`, `2.45.5`, `2.46.1` and `3.0.1` depending on release line.\n- Test whether `/mcp-oauth/register` and `/mcp-oauth/authorize` are reachable without authentication on your instance.","fix":"- n8n `1.123.89`\n- n8n `2.45.5`\n- n8n `2.46.1`\n- n8n `3.0.1`","status":"open","published_at":"2026-10-28T08:48:38+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","triaged_at":"2026-11-09T22:56:52+00:00","updated_at":"2026-11-09T22:56:52+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:56:52Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `1.123.89`\n- n8n `2.45.5`\n- n8n `2.46.1`\n- n8n `3.0.1`","reach":"internet","title":"n8n: MCP OAuth endpoints let attackers redirect visitors to any site","impact":"low","summary":"n8n's MCP OAuth registration and authorization endpoints are enabled by default and need no login, so anyone can register a client with an arbitrary redirect URI. A victim who opens a crafted authorization link is sent on to that attacker-chosen address, turning the instance into an open redirector; no tokens or session data are included in the redirect.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","mcp"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"visitors get redirected to attacker-chosen sites, enabling phishing","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the npm package version; affected builds are below `1.123.89`, `2.45.5`, `2.46.1` and `3.0.1` depending on release line.\n- Test whether `/mcp-oauth/register` and `/mcp-oauth/authorize` are reachable without authentication on your instance.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["patched-version","endpoints-blocked-at-proxy"],"who_is_affected":"Instances running n8n with the MCP OAuth endpoints reachable, which are enabled by default and need no authentication. Exposure depends on whether those paths are exposed to the internet or only to trusted users, and the advisory notes that blocking them at a proxy is a short-term mitigation only. Instances already on a fixed version in their release line are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000829,"input_tokens":5008,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'/mcp-oauth/authorize':234C '/mcp-oauth/register':232C '1.123.89':173C '2.45.5':174C '2.46.1':175C '3.0.1':177C '7x3w':13A,18A '8jc8':12A,17A 'access':209C,229C 'address':74B 'administr':199C 'ai':24B 'ai-tool':23B 'anyon':48B 'appli':215C 'arbitrari':55B,117C 'attack':72B 'attacker-chosen':71B 'authent':107C 'author':37B,64B,98C,123C 'block':227C 'caller':109C 'check':136C 'chosen':73B 'client':7A,52B,114C 'consid':201C 'control':219C 'could':110C 'craft':63B,122C,162C 'data':86B,150C 'default':42B,103C 'dynam':6A 'educ':236C 'enabl':40B,101C 'endpoint':38B,99C,235C,250C 'fix':169C 'follow':203C,240C 'fulli':211C,255C 'ghsa':10A,15A 'ghsa-rc3w-8jc8-7x3w':9A,14A 'host':30B 'immedi':197C 'impact':92C 'includ':88B,152C 'instanc':77B,134C,141C,208C,247C 'issu':166C 'later':187C 'level':218C 'link':65B,242C 'login':46B 'mcp':4A,26B,33B,94C 'measur':269C 'mitig':205C,268C 'n8n':19A,20A,21A,22A,27B,31B,140C,171C,207C,246C 'need':44B 'network':217C 'network-level':216C 'oauth':5A,34B,95C,113C,249C 'one':182C 'open':1A,61B,80B,144C,160C 'patch':164C 'point':243C 'possibl':198C 'proxi':224C 'ran':137C 'rc3w':11A,16A 'redirect':2A,56B,91B,118C,126C,155C 'redirector':81B,145C 'regist':50B,111C 'registr':8A,35B,96C 'remedi':189C,256C 'requir':105C 'restrict':206C 'revers':223C 'reverse-proxi':222C 'risk':258C 'rule':225C 'self':29B 'self-host':28B 'sent':67B 'session':85B,149C 'short':266C 'short-term':265C 'temporari':204C 'term':267C 'token':83B,147C 'tool':25B 'trust':212C 'turn':75B,138C 'unauthent':228C 'unsolicit':241C 'upgrad':180C,194C 'uri':57B,119C,131C 'url':124C,163C 'use':263C 'user':178C,213C,237C 'version':172C,185C 'via':3A 'victim':59B,157C 'visitor':128C 'vulner':191C 'workaround':192C,252C","nicknames":[],"mitigations":[],"who_affected":"Instances running n8n with the MCP OAuth endpoints reachable, which are enabled by default and need no authentication. Exposure depends on whether those paths are exposed to the internet or only to trusted users, and the advisory notes that blocking them at a proxy is a short-term mitigation only. Instances already on a fixed version in their release line are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","mcp","medium","n8n","npm","selfhosted"],"campaign_type":null,"search_a":"'7x3w':13A,18A '8jc8':12A,17A 'client':7A 'dynam':6A 'ghsa':10A,15A 'ghsa-rc3w-8jc8-7x3w':9A,14A 'mcp':4A 'n8n':19A,20A,21A,22A 'oauth':5A 'open':1A 'rc3w':11A,16A 'redirect':2A 'registr':8A 'via':3A","search_b":"'address':74B 'ai':24B 'ai-tool':23B 'anyon':48B 'arbitrari':55B 'attack':72B 'attacker-chosen':71B 'author':37B,64B 'chosen':73B 'client':52B 'craft':63B 'data':86B 'default':42B 'enabl':40B 'endpoint':38B 'host':30B 'includ':88B 'instanc':77B 'link':65B 'login':46B 'mcp':26B,33B 'n8n':27B,31B 'need':44B 'oauth':34B 'open':61B,80B 'redirect':56B,91B 'redirector':81B 'regist':50B 'registr':35B 'self':29B 'self-host':28B 'sent':67B 'session':85B 'token':83B 'tool':25B 'turn':75B 'uri':57B 'victim':59B","search_c":"'/mcp-oauth/authorize':234C '/mcp-oauth/register':232C '1.123.89':173C '2.45.5':174C '2.46.1':175C '3.0.1':177C 'access':209C,229C 'administr':199C 'appli':215C 'arbitrari':117C 'authent':107C 'author':98C,123C 'block':227C 'caller':109C 'check':136C 'client':114C 'consid':201C 'control':219C 'could':110C 'craft':122C,162C 'data':150C 'default':103C 'educ':236C 'enabl':101C 'endpoint':99C,235C,250C 'fix':169C 'follow':203C,240C 'fulli':211C,255C 'immedi':197C 'impact':92C 'includ':152C 'instanc':134C,141C,208C,247C 'issu':166C 'later':187C 'level':218C 'link':242C 'mcp':94C 'measur':269C 'mitig':205C,268C 'n8n':140C,171C,207C,246C 'network':217C 'network-level':216C 'oauth':95C,113C,249C 'one':182C 'open':144C,160C 'patch':164C 'point':243C 'possibl':198C 'proxi':224C 'ran':137C 'redirect':118C,126C,155C 'redirector':145C 'regist':111C 'registr':96C 'remedi':189C,256C 'requir':105C 'restrict':206C 'revers':223C 'reverse-proxi':222C 'risk':258C 'rule':225C 'session':149C 'short':266C 'short-term':265C 'temporari':204C 'term':267C 'token':147C 'trust':212C 'turn':138C 'unauthent':228C 'unsolicit':241C 'upgrad':180C,194C 'uri':119C,131C 'url':124C,163C 'use':263C 'user':178C,213C,237C 'version':172C,185C 'victim':157C 'visitor':128C 'vulner':191C 'workaround':192C,252C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:38+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-rc3w-8jc8-7x3w","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w","severity":"medium","published_at":"2026-10-28T08:48:38+00:00","modified_at":"2026-10-28T08:48:38+00:00","first_seen_at":"2026-11-09T22:53:25+00:00","fetched_at":"2026-11-09T22:53:25+00:00","note":null}],"documents":[{"id":110630,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}