UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126385

n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback

Severity
Medium 4.8
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
2.45.5, 2.46.1, 3.0.1
Weakness
Missing authentication (CWE-306)
Attack
Over the network · Only under certain conditions · Needs a user account · Needs someone to click or open something
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Sources
CVE Program

Description

n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.

From the CVE Program.

Affected software

SoftwareAffected versions
n8nServers and applications · cna:n8n-io|n8n
  • Every version before 2.45.5
  • From 2.46.0 before 2.46.1
  • From 3.0.0 before 3.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126385