Evidence · DiggingBeagle record
n8n embedded Chat Trigger authentication advisory
Security advisory on mode-specific setup endpoint exceptions exposing protected chat state and workflow invocation.
- Source role
- primary disclosure
Evidence record
Security advisory on mode-specific setup endpoint exceptions exposing protected chat state and workflow invocation.
Claim-level citations (2)
- supportsn8n embedded Chat Trigger setup bypassed configured user authentication: The n8n advisory reports that an exception intended for hosted chat setup also covered embedded Chat Trigger sessions configured for user authentication, exposing history or workflow actions under specific conditions.
GHSA-pwj5-wwm6-g83j: embedded/hosted mode distinction, GET setup and affected versions
- supportsn8n embedded Chat Trigger setup bypassed configured user authentication: An n8n Chat Trigger authentication exception intended for hosted setup applied to embedded chat sessions configured for user authentication. The attacker needed the relevant endpoint and in some cases a known session identifier; the issue was not an arbitrary n8n administrator login bypass. The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.
GHSA-pwj5-wwm6-g83j: embedded/hosted mode distinction, GET setup and affected versions