n8n Addresses Critical JWT Flaw Allowing Cross-Issuer Account Takeovers in Enterprise Feature

BERLIN — Workflow automation platform n8n disclosed a critical security vulnerability on July 16, 2026, that allowed attackers to bypass identity verification and gain unauthorized access to enterprise accounts. The flaw resided within the company's token exchange feature for its Enterprise tier, specifically affecting how the system validated JSON Web Tokens (JWTs).

The vulnerability stemmed from a logic error in n8n's authentication process. While the platform correctly matched subject claims within incoming tokens—identifying which user was attempting to log in—it failed to validate the issuer field. This oversight meant that an attacker possessing a valid token issued by one trusted identity provider could use it to authenticate as any other user, provided the subject claim matched, regardless of whether the token originated from the expected service.

Security researcher bearsyankees identified and reported the issue through GitHub. The discovery highlighted how attackers could exploit tokens from different issuers to log into accounts belonging to a separate issuer, effectively bypassing standard security boundaries designed for multi-tenant enterprise environments. This type of flaw is particularly dangerous in automation platforms where users often delegate high-level permissions to workflows that can execute code and manage sensitive data across connected services.

The vulnerability was active until n8n deployed patches following the disclosure on July 16 at approximately 13:39 UTC. The platform's engineers confirmed that the fix enforces strict validation of the issuer field alongside subject claims, ensuring tokens are only accepted from authorized sources configured for specific tenants. Prior to this update, any organization utilizing the Enterprise token exchange feature with multiple identity providers was potentially exposed to account takeover risks.

While n8n has addressed the code defect, questions remain regarding the extent of potential exposure during the window the vulnerability existed. It is unclear how many organizations were actively using the affected configuration or if malicious actors had already leveraged the flaw before its public disclosure. The platform's security team stated they are monitoring for any anomalous login patterns associated with this vector but have not released data on whether active exploitation occurred.

The incident underscores the complexity of managing identity in federated authentication systems, where a single missing validation check can compromise an entire ecosystem. As organizations increasingly rely on automated workflows to bridge disparate services, ensuring rigorous token verification remains essential to preventing unauthorized access.