Post-takeover lateral movement via cross-issuer n8n session accessing workflows/credentials

Ethan Andrews@eandrews

•updated Jul 16, 2026•4•0•11

Detects anomalous post-authentication activity in n8n where the authentication issuer for an account changes from historical norms. This identifies potential account takeover (ATO) scenarios where a hijacked token or cross-issuer session is used to perform lateral movement, workflow manipulation, credential access, or data exfiltration, consistent with behaviors associated with vulnerabilities like CVE-2026-59208.