![\"\"](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/07\/n8n-main.jpg\")
<\/a><\/p>\nn8n<\/a>, the workflow automation platform, handed out the wrong accounts at login. On Enterprise instances configured to trust more than one external token issuer, it matched an incoming JWT to a local user on the\u00a0sub\u00a0claim alone and ignored\u00a0iss.<\/p>\n A valid token from issuer A carrying a\u00a0sub\u00a0that belongs to someone under issuer B logged you in as them. Their password never came into it. n8n shipped the fix on June 24.<\/p>\n The flaw is tracked as\u00a0CVE-2026-59208<\/a>. The CVE record did not go public until July 9. n8n\u00a0credits the report<\/a>\u00a0to the GitHub account bearsyankees<\/a>, whose profile lists Strix, which makes an AI penetration testing agent.<\/p>\n Strix\u00a0says<\/a>\u00a0it pointed out that the agent at the token-exchange flow and found the identity-binding bug there.<\/p>\n Two issuers, one account<\/p>\n Token exchange is n8n’s Enterprise route for\u00a0OEM partners who embed the product<\/a>, an\u00a0RFC 8693 implementation<\/a>\u00a0that spares their users a second login screen.<\/p>\n The partner signs a short-lived JWT with its own key, n8n verifies it against a configured public key, matches the claims to a local account, and the user is in. Trusted keys go in N8N_TOKEN_EXCHANGE_TRUSTED_KEYS, and the\u00a0deployment docs<\/a>\u00a0still tag the feature as preview.<\/p>\n The token itself checks out. The matching is the bug. A\u00a0sub\u00a0value is only guaranteed to be unique inside the issuer that minted it.\u00a0RFC 7519<\/a>\u00a0asks that it be “scoped to be locally unique in the context of the issuer” or else globally unique. The identifier for a user is therefore\u00a0the pair,\u00a0iss\u00a0plus\u00a0sub<\/a>.<\/p>\n <\/p>\n n8n keyed on half of it. Nothing stops two issuers from emitting the same subject string, and when they do, both land on one n8n account.<\/p>\n How big a deal is this<\/p>\n The flaw reaches an instance only if token exchange is switched on and the config trusts at least two external issuers.\u00a0n8n says<\/a>\u00a0nothing else is affected. Token exchange is Enterprise-only and still flagged as a preview, so the exposed set is small and specific: OEM deployments, where trusting a second issuer is a supported configuration.<\/p>\n What the advisory does not pin down is how an attacker gets the token. It says only that they can obtain one. The practical question is whether an ordinary user at a trusted issuer can influence the\u00a0sub\u00a0they receive. The public record does not answer it. GitHub’s CVSS 4.0 vector marks attack requirements as present and stops there.<\/p>\n GitHub assigned that vector. As the CNA here, it puts\u00a0CVE-2026-59208\u00a0at 7.6 on CVSS 4.0, high. NVD puts the same bug at 6.8 on CVSS 3.1, medium, and has not issued a 4.0 assessment at all; its record carries\u00a0CWE-287\u00a0and\u00a0CWE-346. CISA’s July 13 SSVC assessment records exploitation as none, and The Hacker News found no public proof-of-concept in searches on July 16.<\/p>\n Two weeks before the June 24 fix, the maintainers patched\u00a0CVE-2026-54305<\/a>, another Enterprise-only flaw. It lets any authenticated user overwrite or revoke another user’s stored OAuth tokens through the Dynamic Credentials endpoints. That one was a missing ownership check, not an identity binding. Different bug, same surface.<\/p>\n The Hacker News has reached out to n8n for confirmation on the scope and impact of\u00a0CVE-2026-59208\u00a0and will update this story with any response.<\/p>\n Patch or cut the issuer list<\/p>\n CVE-2026-59208\u00a0affects every n8n release below 2.27.4 and version 2.28.0. The fix first landed in 2.27.4 and 2.28.1. Those are the floor. On July 16, n8n’s npm package carried 2.30.6 on both its latest\u00a0and\u00a0stable\u00a0tags. It ships a new minor most weeks by its own account, so check the tag and take the newest stable build your deployment supports.<\/p>\n If patching has to wait, work out what you are running:\u00a0N8N_TOKEN_EXCHANGE_TRUSTED_KEYS\u00a0holds the trusted signing keys, and a separate preview flag controls whether token exchange is on at all. Cut back to a single trusted issuer, or turn the feature off.<\/p>\n The advisory calls both short-term measures and says neither fully remediates the risk. That is boilerplate, identical in at least three other n8n advisories, including the June 10 one. By n8n’s own scope statement, an instance with token exchange off is not affected.<\/p>\n Neither release note mentions the fix. The Hacker News checked both: between them, the\u00a02.27.4<\/a>\u00a0and\u00a02.28.1<\/a>\u00a0changelogs cover a Python import fix, a Google Ads node upgrade, an AI workflow check, and a node-building change, and nothing about identity.<\/p>\n The advisory is where this one lives. If your upgrade decisions run on changelogs, this is the kind of fix that slips past.<\/p>\n","protected":false},"excerpt":{"rendered":"\ue804Swati Khandelwal\ue802Jul 16, 2026Vulnerability \/ Web Security n8n, the workflow automation platform, handed out the wrong accounts at…\n","protected":false},"author":2,"featured_media":552804,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-552803","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/552803","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=552803"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/552803\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/552804"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=552803"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=552803"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=552803"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}<\/a><\/p>\n