---
id: "GHSA-rc3w-8jc8-7x3w"
page: "https://infrastack.ai/live/GHSA-rc3w-8jc8-7x3w"
kind: "vulnerability"
aliases: ["GHSA-rc3w-8jc8-7x3w"]
title: "Open Redirect via MCP OAuth Dynamic Client Registration"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": [">= 1.123.89"], "affected": "< 1.123.89", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.46.1"], "affected": "< 2.46.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.45.5"], "affected": "< 2.45.5", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 3.0.1"], "affected": "< 3.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "mcp", "n8n", "self-hosted"]
not_affected_if: ["endpoints-blocked-at-proxy", "patched-version"]
published_at: "2026-10-28T08:48:38+00:00"
first_seen_at: "2026-11-09T22:53:25+00:00"
updated_at: "2026-11-09T22:56:52+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w", "first_seen_at": "2026-11-09T22:53:25+00:00"}]
exploit_sources: []
---

# Open Redirect via MCP OAuth Dynamic Client Registration

Link for people: https://infrastack.ai/live/GHSA-rc3w-8jc8-7x3w (this .md is for agents)

n8n's MCP OAuth registration and authorization endpoints are enabled by default and need no login, so anyone can register a client with an arbitrary redirect URI. A victim who opens a crafted authorization link is sent on to that attacker-chosen address, turning the instance into an open redirector; no tokens or session data are included in the redirect.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.89 fixed >= 1.123.89
- npm:n8n affected < 2.46.1 fixed >= 2.46.1
- npm:n8n affected < 2.45.5 fixed >= 2.45.5
- npm:n8n affected < 3.0.1 fixed >= 3.0.1

## How to check

- Check the n8n version with `n8n --version` or the npm package version; affected builds are below `1.123.89`, `2.45.5`, `2.46.1` and `3.0.1` depending on release line.
- Test whether `/mcp-oauth/register` and `/mcp-oauth/authorize` are reachable without authentication on your instance.

## Fix

- n8n `1.123.89`
- n8n `2.45.5`
- n8n `2.46.1`
- n8n `3.0.1`

## Timeline

- 2026-11-09T22:53:25+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-rc3w-8jc8-7x3w

## From the sources

## Impact

The MCP OAuth registration and authorization endpoints are enabled by default and require no authentication. Any caller could register an OAuth client with an arbitrary `redirect_uri`, and a crafted authorization URL then redirected the visitor to that URI before the instance's checks ran, turning the n8n instance into an open redirector. No tokens or session data were included in the redirect. A victim had to open the crafted URL.

## Patches

The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Apply network-level controls or a reverse-proxy rule to block unauthenticated access to the `/mcp-oauth/register` and `/mcp-oauth/authorize` endpoints.
- Educate users not to follow unsolicited links pointing to your n8n instance's OAuth endpoints.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_