Auth bypass in N8n-io N8n
CVE-2026-65594
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. O…
Vulnerability class: Broken Access Control
Affected products
- N8n-io N8n — versions 0, 2.30.1, 2.29.8
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)