n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
n8n
- Severity
- High, CVSS 8.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L
- Record
- GHSA-8342-988q-86cr
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 22, 2026
- Source last modified
- July 22, 2026
Description
Impact
In an n8n instance, when a validly-signed incoming token was matched to a local account by its email claim, the service did not check that the trusted key's permitted role ceiling covered that account, nor that the email claim was verified. As a result, anyone able to obtain a token accepted by one of the configured trusted keys, for example a trusted issuer that emitted unverified email addresses, could authenticate as any existing user, gaining full account control.
This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
Patches
The issue has been fixed in n8n version 2.32.1. Users should upgrade to this version or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Disable the embed login feature by setting N8N_TOKEN_EXCHANGE_ENABLED=false.
- If embed login cannot be disabled, restrict network access to the n8n instance to fully trusted parties only, and audit all configured trusted keys and their allowedRoles assignments.
- Review auth_identity records for unexpected token-exchange entries linked to high-privilege accounts.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Description quoted from the GitHub Advisory Database.
Who is affected
n8n is a tool that connects different apps and automates tasks between them. This flaw affects n8n setups where the embed login feature is turned on and at least one trusted key source is set up. In those setups, n8n matched incoming sign-in tokens to accounts by email address. It did not check that the email was verified, or that the trusted key was allowed to sign in to an account with that role. Anyone able to get a token accepted by one of the trusted keys could sign in as any existing user and take full control of that account. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should update it to version
2.32.1or later. - If an IT provider or vendor runs n8n for you, send them this advisory and ask when the update will be done.
- If you cannot update right away, turn off the embed login feature by setting
N8N_TOKEN_EXCHANGE_ENABLED=false. This only reduces the risk for a short time, so still update. - If embed login cannot be turned off, allow only fully trusted parties to reach n8n over the network. Also review every configured trusted key and the roles each one is allowed to grant.
- Check n8n's stored sign-in identities for unexpected embed login entries linked to high-privilege accounts.
Analysis written from the source record as of July 22, 2026 and reviewed before publishing.