Skip to content
AI Sec Watch
MediumVulnerability

GHSA-vpgc-2f6g-7w7x: n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-33720GHSA-vpgc-2f6g-7w7x
Published
Record updated
View JSON
Affected
  • n8n < 2.8.0
Fixed in
2.8.0
  • released February 10, 2026, 43 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.2%

Summary

GHSA-vpgc-2f6g-7w7x affects n8n instances that explicitly set N8N_SKIP_AUTH_ON_OAUTH_CALLBACK to true. With that setting, the OAuth callback handler skips ownership verification of the OAuth state parameter, so an attacker can trick a victim into completing an OAuth flow against an attacker-controlled credential object. The victim's OAuth tokens are then stored in the attacker's credential, letting the attacker run workflows in the victim's name. The default configuration is not affected.

Mitigation

Fixed in n8n version 2.8.0; upgrade to 2.8.0 or later. If upgrading is not immediately possible, avoid enabling N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true unless strictly required and restrict instance access to fully trusted users only. The source notes these workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • n8nnpmLLM dependency since 2026-02-10

Related items