GHSA-vjf3-2gpj-233v: n8n has an SSO Enforcement Bypass in its Self-Service Settings API
Summary
An authenticated user who logged in through SSO (single sign-on, a system where one login works across multiple services) could bypass their organization's SSO policy by disabling SSO enforcement for their own account through the n8n API (a set of tools that let software communicate with n8n). This allowed them to create a local password and log in directly, avoiding the organization's centralized identity management and multi-factor authentication requirements.
Solution / Mitigation
The issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can: (1) Monitor audit logs for users who create local credentials after authenticating via SSO, and (2) Restrict the n8n instance to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-vjf3-2gpj-233v
First tracked: February 26, 2026 at 07:00 PM
Classified by LLM (prompt v3) · confidence: 95%