CVE-2026-72772 in n8n
Summary
by MITRE • 08/11/2026
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in n8n versions prior to 2.32.1 and 2.31.5 represents a critical authentication flaw that enables unauthorized account takeover through the Token Exchange Embed Login functionality. This security weakness stems from insufficient validation of token attributes during the authentication process, specifically failing to verify email address verification status and role permissions. The vulnerability operates by exploiting the trust relationship between the system and external identity providers, where valid tokens signed by trusted issuers can be used to impersonate existing users without proper authorization checks.
The technical flaw manifests in the authentication flow where the system accepts a token containing an email claim and automatically matches it to an existing local account based on that email address. However, the system neglects to validate whether the email address within the token has been verified by the identity provider, nor does it confirm that the trusted key's role ceiling encompasses the privileges required for the target account. This oversight creates a path for attackers to leverage tokens from untrusted or misconfigured identity providers that may issue unverified email addresses, effectively bypassing normal authentication controls.
The operational impact of this vulnerability extends beyond simple unauthorized access to full account compromise and privilege escalation. An attacker with access to a token accepted by the configured trusted key can assume control of any existing user account within the system, gaining complete administrative capabilities and access to all associated data and resources. This risk is particularly severe in environments where the embed login feature is actively enabled and multiple trusted key sources are configured, as it provides attackers with multiple potential entry points for exploitation.
Security implications align with CWE-287 Authentication Bypass Through Modification of Authentication Tokens, where insufficient validation of authentication parameters allows unauthorized access to protected resources. The vulnerability also maps to ATT&CK technique T1078 Valid Accounts, as it enables adversaries to leverage legitimate user accounts through manipulated authentication tokens. Organizations should implement immediate mitigations including updating to n8n 2.32.1 or 2.31.5, disabling the embed login feature if not required, and reviewing all trusted key configurations to ensure proper email verification enforcement and role-based access controls are implemented.
The root cause of this vulnerability demonstrates a fundamental flaw in the authentication system's trust model, where the system assumes that any token matching an existing account can be trusted without sufficient validation checks. Proper implementation should include mandatory email verification status checks and comprehensive role permission validation against the issuing key's capabilities. Organizations with affected systems should conduct immediate security assessments to identify potentially compromised accounts and implement additional monitoring for suspicious authentication patterns. The vulnerability highlights the importance of defense-in-depth principles in authentication systems, where multiple validation layers should be implemented rather than relying solely on token matching alone.