CVE-2026-126385: n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback
n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.45.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.46.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.1
Event History
Frequently Asked Questions
Which deployments are affected?
Affected versions are n8n before 2.45.5, versions 2.46.x before 2.46.1, and 3.x before 3.0.1. The issue applies to OAuth2 credentials used through the dynamic-credential connect flow.
What does an attacker need to exploit this?
The attacker must be an n8n member with access to a resolvable OAuth2 credential. They must send that credential's provider authorization URL to a victim and convince the victim to authorize it.
Does the victim need to be logged in to n8n?
No. The described attack succeeds when the victim consents to the provider authorization request without an active n8n session. The resulting OAuth tokens are then stored under the attacking member's identity.
What is the practical impact after successful exploitation?
The attacker's workflows can act as the victim using the OAuth tokens obtained through the consent flow. The provided vector indicates confidentiality and integrity impact, with no availability impact stated.