n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer

A vulnerability in n8n's Enterprise token exchange feature, tracked as CVE-2026-59208, allowed attackers to log in as users from another issuer due to improper validation of JWT tokens. The flaw occurred when n8n matched incoming tokens solely on the 'sub' claim without verifying the 'iss' (issuer), enabling account takeover if two trusted issuers used overlapping subject identifiers. The issue affects n8n versions prior to 2.27.4 and 2.28.1, and while the feature is limited to Enterprise deployments in preview, it poses a high-severity risk for misconfigured systems.

AI-extracted · verify before operational use