{"data":{"id":"79ac9ef5-a8dd-4673-b503-5bcc33c27c2b","title":"GHSA-6h4j-wcr9-2vg7: n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints","summary":"The OAuth1 and OAuth2 credential reconnect endpoints in n8n authorized access using `credential:read` instead of `credential:update`. An authenticated user with read-only access to a shared credential could start a reconnect flow and overwrite its stored tokens with ones tied to an external account they control, so workflows using that credential would run under the attacker's identity. The issue affects instances where credentials are shared with other users or across projects.","solution":"Fixed in n8n versions 1.123.43, 2.20.7, and 2.21.1; users should upgrade to one of these or later. If upgrading is not immediately possible, restrict credential sharing to fully trusted users only and audit shared credentials for unexpected OAuth token changes, revoking any tokens that may have been replaced. These workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-6h4j-wcr9-2vg7","publishedAt":"2026-05-14T16:18:14.000Z","cveId":"CVE-2026-45732","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@>= 2.0.0-rc.0, < 2.20.7 (fixed: 2.20.7)","n8n@>= 2.21.0, < 2.21.1 (fixed: 2.21.1)","n8n@< 1.123.43 (fixed: 1.123.43)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0035,"epssCheckedAt":"2026-11-07T06:14:03.427Z","kevDateAdded":null,"advisoryAliases":["GHSA-6h4j-wcr9-2vg7"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-05-14T16:18:14.000Z","fixReleasedAt":"2026-05-13T06:10:03.062Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:36:19.763Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.20.7","matchedVersion":"2.20.7","fixReleasedAt":"2026-05-13T06:15:25.821Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:19.617Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.43","matchedVersion":"1.123.43","fixReleasedAt":"2026-05-13T06:10:03.062Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:19.617Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.21.1","matchedVersion":"2.21.1","fixReleasedAt":"2026-05-13T06:15:21.942Z","daysToFix":-1,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:36:19.617Z"}]}}