Sign In
Advisories

n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback

Go back
Severity
medium
Date
Affecting

  • n8n >= 2.46.0, < 2.46.1

  • n8n >= 0, < 2.45.5

  • n8n >= 3.0.0, < 3.0.1

CWE
  • CWE-306 Missing Authentication for Critical Function
CVSS
4.8
CVSS V4 Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Credit
sm1ee
Description
n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim's tokens are stored under the member's identity, letting the member's workflows act as the victim.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.
  • Vulnerability Prioritization
    Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
  • Early Warning System
    Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.
Schedule a Demo