GHSA-426f-xmcv-g8pg: n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback
n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.45.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.46.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.0.1
Event History
Frequently Asked Questions
Which deployments should be updated?
Update n8n versions before 2.45.5, versions in the 2.46.x line before 2.46.1, and 3.x versions before 3.0.1.
What does an attacker need to exploit this issue?
The attacker must be an n8n member with access to a resolvable OAuth2 credential. They must send the associated provider authorization URL to a victim and induce the victim to consent.
Does exploitation require the victim to be logged in to n8n?
No. The described attack specifically succeeds when the victim consents without an active n8n session, causing the victim's tokens to be stored under the attacker's member identity.
What is the practical impact after a successful attack?
The attacker's workflows can act using the victim's OAuth tokens. The vulnerability affects the dynamic-credential connect flow.