OAuth2 Token Theft in n8n Workflow

Executive Summary

CVE-2026-126385 is an OAuth account hijacking flaw in n8n versions before 2.46.1, 2.45.5, and 3.0.1. It occurs in the OAuth2 credential callback process where authentication is missing. An attacker with access to an OAuth2 credential can trick a victim into authorizing access without an active n8n session. The victim's tokens are then stored under the attacker's identity, allowing the attacker's workflows to act as the victim.

Useful 0 Not Useful 0

Detection Guidance

Check n8n version with 'n8n --version' or inspect package.json for version details. Monitor OAuth callback logs for unauthorized token storage under different user identities. Review workflows for unexpected OAuth credential usage or unauthorized access patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to impersonate a victim in OAuth provider interactions. The attacker can access the victim's data and perform actions on their behalf. The attack requires low privileges and user interaction, making it easier to exploit. It impacts confidentiality and integrity but does not affect availability.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade n8n to version 2.46.1, 2.45.5, or 3.0.1 or later. Enable browser-session binding in OAuth flows. Restrict instance access to trusted users only. Audit and remove unnecessary user permissions. Disable dynamic credential features if not required.

Useful 0 Not Useful 0