CVE-2026-72772
Received Received - Intake

Account Takeover via Token Exchange in n8n

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: VulnCheck

Description
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-72772
EUVD
EUVD-2026-56098

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n8n n8n to 2.31.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-640 The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72772 is a high-severity vulnerability in n8n versions before 2.32.1 and 2.31.5. It allows account takeover via the Token Exchange Embed Login feature. When a validly-signed token matches a local account by email claim, the system fails to verify if the email claim was verified or if the trusted key's permitted role covers that account. Attackers can exploit this to authenticate as any existing user and gain full account control.

Detection Guidance

Check n8n version with: n8n --version. If version is below 2.32.1 or 2.31.5, the system is vulnerable. Review logs for embed login token exchange attempts. Inspect trusted key configurations and auth_identity records for misconfigurations.

Impact Analysis

This vulnerability allows attackers to take over user accounts, gaining full control over them. If you use n8n with the embed login feature enabled and a trusted key source configured, your account could be compromised. Attackers only need to obtain a token from a trusted issuer to exploit this issue.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with access controls, and failure to protect personal health or user information, potentially leading to legal and financial penalties.

Mitigation Strategies

Upgrade n8n to version 2.32.1 or later. Disable the embed login feature if not required. Restrict network access to n8n instances. Audit trusted keys and remove any unverified or unnecessary sources. Review and verify all auth_identity records.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72772. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart