Critical Authentication Bypass in n8n Token Exchange

A critical vulnerability, CVE-2026-59208, was identified in the n8n workflow automation platform's Enterprise-only token exchange feature. The flaw stems from an identity-binding error where the application matched incoming JSON Web Tokens (JWT) to local user accounts based solely on the 'sub' (subject) claim, while failing to verify the 'iss' (issuer) claim. This allows an attacker who can obtain a valid token from any trusted issuer to hijack accounts of users associated with a different trusted issuer, provided they share the same subject identifier.

Technical analysis reveals that while the verification step correctly checked cryptographic signatures and issuer fields, the subsequent identity resolution service dropped the issuer context. This collapsed multiple identities onto a single local account. Additionally, a related flaw (CVE-2026-54305) was identified in the Dynamic Credentials endpoints, which could allow authenticated users to manipulate OAuth tokens of others due to missing ownership checks.

These vulnerabilities primarily affect Enterprise deployments using n8n as an OEM integration with multiple trusted identity providers. Given n8n's role in orchestrating sensitive data and credentials across hundreds of integrations, an account takeover poses a severe risk of data exfiltration and lateral movement within automated environments. Organizations should update to the patched versions immediately.