n8n Enterprise dynamic OAuth callback identity binding advisory

Evidence record

Maintainer account-binding vulnerability involving OAuth consent and a separate n8n login session.

Read the original source ↗

Claim-level citations (2)

• supportsn8n Enterprise OAuth callback attached consent to the wrong workflow user: The n8n Enterprise OAuth advisory describes an end-user credential-connect callback that could associate a consenting person’s provider token with the wrong n8n member when the necessary session check was absent.

  GHSA-426f-xmcv-g8pg: attack steps, identity confusion and patched versions

• supportsn8n Enterprise OAuth callback attached consent to the wrong workflow user: An Enterprise dynamic-credential authorization callback could associate an OAuth provider token with the n8n member who initiated the flow instead of the person who consented. The attacker needed to send the authorization link to another person who then completed a valid provider consent outside a matching n8n browser session. The initiating account could receive a provider token belonging to the consenting user under its own dynamic credential record.

  GHSA-426f-xmcv-g8pg: attack steps, identity confusion and patched versions