n8n: N8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange…
n8n
- Severity
- High, CVSS 8.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Record
- CVE-2026-72772
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 11, 2026
- Source last modified
- October 24, 2026
Description
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting different apps and automating routine tasks between them. This flaw affects n8n versions before 2.32.1 (and before 2.31.5), but only where the embed login feature is turned on and at least one trusted key source is set up. The embed login feature lets people sign in using a token from an outside service the product trusts. Because of this flaw, anyone able to get a token accepted by one of those trusted keys could sign in as any existing user and take full control of that account. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should check whether the embed login feature is turned on and at least one trusted key source is set up. Only those setups are affected by this flaw.
- That person should update n8n to version
2.32.1or2.31.5, which fix this flaw. If your setup is affected, do this as soon as possible. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask whether your setup is affected and when the update will be done.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.