CVE-2026-59208: n8n Multi-Issuer JWT Identity Bypass – Account Takeover Risk

Technical summary

In n8n versions before 2.27.4 and 2.28.1, the JWT identity resolution logic during token exchange authentication fails to validate the 'iss' (issuer) claim alongside the 'sub' (subject) claim when mapping external identities to local accounts. An attacker obtaining a valid JWT from a trusted issuer with a 'sub' value matching an existing n8n user's identifier can authenticate as that user, bypassing intended identity boundaries. The vulnerability exists in multi-issuer configurations where separate token-exchange authentication providers should maintain isolated identity namespaces but do not. This represents an authentication bypass rooted in incomplete JWT validation (CWE-287) and missing issuer verification (CWE-346).

Business impact

Organizations running n8n with federated authentication across multiple identity providers face unauthorized account takeover. An insider or attacker with valid credentials from one identity system could impersonate administrators or other users in connected n8n instances, leading to unauthorized workflow execution, data exfiltration through automated processes, or modification of critical automations. The impact is heightened in environments where n8n orchestrates sensitive business processes, customer data handling, or infrastructure changes.

Affected systems

n8n versions prior to 2.27.4 and versions 2.28.0 up to (but not including) 2.28.1 are affected. The vulnerability is specific to instances configured with multiple trusted token-exchange issuers; single-issuer deployments remain unaffected. Both self-hosted and cloud n8n deployments using federated identity authentication are in scope.

Exploitability

Exploitation requires an attacker to already possess a valid JWT from one trusted issuer (CWE-346 context: issuer spoofing protection absent). The CVSS vector (AC:H) reflects that additional conditions must align—specifically, the attacker's token's 'sub' must match an existing n8n user identifier, and the target environment must trust at least two issuers. Exploitation is post-authentication but does not require elevated privileges on the attacker's source identity, making it viable for lateral movement in federated environments. No user interaction is required.

Remediation

Upgrade to n8n version 2.27.4 if running the 2.27.x line, or to version 2.28.1 if running 2.28.0 or later. Organizations unable to patch immediately should review token-exchange issuer configurations and consider temporarily limiting multi-issuer trust relationships to a single issuer until patched. Audit existing access logs for anomalous cross-issuer authentication patterns.

Patch guidance

Apply the following patches: version 2.27.4 or later (for 2.27.x deployments) and version 2.28.1 or later (for 2.28.x deployments). Verify against the official n8n advisory that your target version is included in the fix. After patching, restart n8n services to ensure the updated authentication validation logic is active. Test multi-issuer token-exchange flows in a non-production environment before rolling out to production systems.

Detection guidance

Monitor n8n audit logs for authentication events where the issuer of a JWT differs from the issuer associated with a user's established identity provider. Flag instances where users authenticate via an unexpected issuer or where a single user identifier appears with multiple issuer claims in a short timeframe. Inspect token-exchange configuration to inventory all trusted issuers and cross-reference against identity provider registrations. Correlate successful authentications against issuer trust lists to identify anomalies.

Why prioritize this

Although the CVSS score is MEDIUM (6.8), the vulnerability enables account takeover in multi-issuer federated identity scenarios, which are increasingly common in enterprise n8n deployments. The flaw is authentication-layer rather than requiring exploitation of downstream logic, making it a foundational security control bypass. Organizations leveraging n8n for critical workflow orchestration across multiple departments or identity systems should prioritize patching to prevent unauthorized process execution and data access.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects high confidentiality and integrity impact (C:H, I:H) but limited availability impact (A:N). Attack complexity is high (AC:H) because specific conditions must align—token validity, issuer trust, and sub matching. The requirement for prior authentication (PR:L) prevents unauthenticated attacks but does not prevent attackers with low privileges on one issuer from escalating within n8n. The score appropriately captures the severity of authentication bypass without overstating it as critical, since exploitation depends on environmental configuration (multi-issuer setup) and issuer sub-claim overlap.

Frequently asked questions