GHSA-pf83-w3f9-8m37: Npm/n8n vulnerability
Impact
The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The patch requires OIDC to be the enabled, active authentication method before either endpoint starts the flow or issues a session.
The issue affects n8n Enterprise instances where OIDC was configured at least once and subsequently disabled.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Disable or revoke the corresponding application or client at the IdP level to prevent the OIDC flow from completing. - Restrict network-level access to the n8n instance to trusted users only.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Configuration
As a short-term mitigation, ensure OIDC is enabled and is the instance's enabled, active authentication method before endpoint flow/session issuance.
n8n Settings (OIDC) OIDC enabled/active authentication method = Enable and make OIDC the enabled, active authentication method before any OIDC endpoint starts the flow or issues a session. - Compensating control
At the IdP level, disable or revoke the corresponding application/client to prevent the OIDC flow from completing.
- Compensating control
Restrict network-level access to the n8n instance to trusted users only.
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects n8n Enterprise instances where OIDC had been configured at least once and was later disabled. OIDC login and callback endpoints could still complete the flow and issue sessions even though OIDC was no longer the active enabled authentication method.
What does an attacker need to exploit this behavior?
The attacker needs access to the public OIDC login or callback endpoints and a corresponding OIDC flow that can complete through the configured identity provider. Disabling OIDC only in n8n Settings did not prevent those endpoints from issuing sessions.
How can the issue be remediated?
Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 or later. These versions require OIDC to be the enabled, active authentication method before the login and callback endpoints start a flow or issue a session.
What can be done while an upgrade is pending?
Disable or revoke the corresponding OIDC application or client at the identity provider to prevent the flow from completing, and restrict network access to the n8n instance to trusted users. These are temporary mitigations and do not fully remediate the issue.