CryptoThe Hacker Newsabout 4 hours ago
n8n Token Flaw Lets Attackers Hijack Accounts
1 min read
A flaw in n8n's Enterprise token exchange matched JWTs on the sub claim alone, ignoring iss. A valid token from issuer A with a sub belonging to issuer B logged the attacker in as that user. n8n shipped the fix on June 24. The flaw is tracked as CVE-2026-59208, rated 7.6 on CVSS 4.0.
Level
Hype check
Tap to vote and see what everyone thinks.
