Security Vulnerability in n8n Allows Unauthorized Access

The workflow automation platform n8n has announced a critical security vulnerability that enables attackers to log in as other users. This flaw particularly affects enterprise instances configured to trust multiple external token issuers. The faulty implementation results in an incoming JSON Web Token (JWT) being matched with a local user solely based on the sub claim, while the iss claim is ignored. A valid token from issuer A containing a sub that belongs to a user under issuer B can allow an attacker to log in as that user without needing to enter the affected user's password.

This security vulnerability could pose a significant risk to the privacy and security of users. The flaw was discovered by security experts and classified as critical. n8n has promptly taken measures to address the issue. The company has announced plans to release an update that corrects the faulty logic in token validation. Users are urged to regularly update their systems to protect against potential attacks.

The exact number of affected users is currently unknown. However, n8n has emphasized that the vulnerability only occurs in specific configurations that allow multiple token issuers. Companies using n8n in such a configuration should be particularly vigilant and review their security protocols. The vulnerability has been registered as CVE-2026-XXXX, with the exact CVE number yet to be published. Security experts recommend that organizations using n8n review their authentication mechanisms to ensure they are not susceptible to this type of attack.

In addition to technical measures, n8n has also developed a communication strategy to inform affected users about the risks and necessary steps to address the security vulnerability. The company plans to provide further information in the coming weeks to keep users updated on the progress of security updates. The discovery of this vulnerability comes at a time when the use of workflow automation platforms in businesses is rapidly increasing. The reliance on such technologies makes it even more critical to adhere to security standards to minimize the risk of data breaches. n8n has stressed that user security is a top priority and that they will do everything possible to ensure the integrity of their platform.

The security vulnerability could have far-reaching consequences for companies relying on n8n. Unauthorized access to user accounts could not only lead to data loss but also undermine user trust in the platform. n8n is committed to taking the necessary steps to enhance the security of their services and prevent future incidents. The release of the update to address the security vulnerability is expected in the coming weeks. Users should regularly check n8n's official channels to ensure they receive the latest security updates and adjust their systems accordingly. The vulnerability was disclosed on July 17, 2026, and n8n has already begun working on a solution.