CVE-2026-86084 in n8n
Summary
by MITRE • 09/09/2026
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in n8n prior to versions 1.123.76, 2.37.7, and 2.38.2 represents a critical authentication bypass flaw within the platform's Single Sign-On implementation. Specifically, the public OpenID Connect login endpoint and its corresponding callback handler failed to verify whether OIDC was currently enabled as an active authentication method before proceeding with session generation. This logic error resides in the enterprise edition source code at packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, affecting functions such as generateLoginUrl and the subsequent callback flow which lacked a necessary assertion check for OIDC login enablement status.
From an architectural perspective, this flaw allows any user with access to the n8n instance URL to initiate or complete an authentication sequence via the OIDC endpoints regardless of the administrator's configured preferences. If an Enterprise administrator had previously configured and subsequently disabled a specific identity provider, the underlying routes remained active and functional. Consequently, attackers could exploit these dormant but accessible endpoints to obtain valid session tokens without proper authorization from the currently enabled authentication mechanism.
The operational impact of this vulnerability is severe as it effectively nullifies access control measures intended by system administrators. An attacker can bypass primary authentication methods such as local password login or other configured identity providers by directly interacting with the OIDC callback endpoint. This results in unauthorized access to the n8n environment, potentially leading to data exfiltration, manipulation of workflow automation logic, and compromise of connected systems that rely on authenticated sessions within the platform.
This issue aligns with CWE-287 Improper Authentication where an entity fails to adequately prove its identity before granting access. Furthermore, it maps to MITRE ATT&CK technique T1078 Valid Accounts as attackers can leverage valid session tokens obtained through this bypass to maintain persistent unauthorized access within the target infrastructure. The failure to enforce state consistency between configuration settings and runtime behavior highlights a gap in security logic validation during request processing.
To mitigate this risk, organizations running affected versions of n8n must immediately upgrade to version 1.123.76, 2.37.7, or 2.38.2 where the assertion check for OIDC login enablement has been properly implemented in the service layer. Until upgrading is possible, administrators should consider restricting network access to n8n endpoints through firewall rules if exposed publicly and monitor logs for unusual authentication patterns originating from OIDC paths that are not supposed to be active. Regular audits of identity provider configurations ensure that disabled services do not leave residual attack surfaces open to exploitation by malicious actors seeking unauthorized entry points into the automation platform.