GHSA-pf83-w3f9-8m37: n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions
- Identifiers
- CVE-2026-86084GHSA-pf83-w3f9-8m37
- Published
- Record updated
- Affected
- n8n >= 2.0.0, < 2.37.7, fixed in 2.37.7, released September 2, 2026, 8 days before disclosure
- n8n >= 2.38.0, < 2.38.2, fixed in 2.38.2, released September 2, 2026, 8 days before disclosure
- n8n < 1.123.76, fixed in 1.123.76, released September 2, 2026, 8 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.5%
Summary
The public OIDC login and callback endpoints in n8n Enterprise ran the full authentication flow and issued sessions even after OIDC was disabled in Settings, leaving an administrator's disabled provider with a working login route. The issue affects instances where OIDC was configured at least once and later disabled, and the fix requires OIDC to be the enabled, active authentication method before either endpoint starts the flow or issues a session.
Mitigation
Fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2; upgrade to one of these or later. Temporary workarounds, which do not fully remediate the risk: disable or revoke the corresponding application or client at the IdP level, and restrict network-level access to the n8n instance to trusted users only.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmDeclares an LLM dependency