{"items":[{"id":"NVI-00016101","kind":"vulnerability","title":"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-mq3m-f8x3-579w","CVE-2026-59208"],"plain_summary":"GitHub lists this reviewed advisory for n8n, n8n. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1ad5335d6c6394726ec323dd621f886c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-25T17:10:00.197Z","value":"6.8 MEDIUM (3.1)","meaning":"nvd@nist.gov severity; no combined Null risk score.","source_id":"sr-4a77c0f0559a7d510c40b435f25c0450"},{"kind":"CVSS","as_of":"2026-10-25T17:10:00.197Z","value":"7.6 HIGH (4.0)","meaning":"security-advisories@github.com severity; no combined Null risk score.","source_id":"sr-4a77c0f0559a7d510c40b435f25c0450"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.265%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.18524. Missing scores are unknown.","source_id":"sr-1ad5335d6c6394726ec323dd621f886c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-21ac352fce6c2ed63ea117a64eac0bdb","url":"https://github.com/advisories/GHSA-mq3m-f8x3-579w","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mq3m-f8x3-579w","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T17:42:43.803Z"},{"id":"sr-4a77c0f0559a7d510c40b435f25c0450","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59208","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-59208","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T08:05:01.676Z"},{"id":"sr-1ad5335d6c6394726ec323dd621f886c","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-59208","publisher":"FIRST EPSS","observed_at":"2026-11-04T23:33:33.054Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-21ac352fce6c2ed63ea117a64eac0bdb"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nWhen an n8n instance is configured with more than one trusted token-exchange issuer, external identities are resolved to local accounts using only the JWT `sub` claim, ignoring the issuer (`iss`). As a result, two different issuers that emit the same subject value map to the same local account.\n\nAn attacker who can obtain a valid token from one trusted issuer with a `sub` matching a victim registered under a different issuer can authenticate as that victim and access their account.\n\nThis issue only affects instances where the token exchange feature is enabled and more than one trusted external issuer is configured.\n\n## Patches\nThe issue has been fixed in n8n version 2.28.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- If multiple trusted issuers are not required, reduce the token exchange configuration to a single trusted issuer.\n- Disable the token exchange feature entirely if it is not in active use.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","public_affected_ranges":[">= 2.28.0, < 2.28.1"]},{"certainty":"source_listed","source_ids":["sr-21ac352fce6c2ed63ea117a64eac0bdb"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nWhen an n8n instance is configured with more than one trusted token-exchange issuer, external identities are resolved to local accounts using only the JWT `sub` claim, ignoring the issuer (`iss`). As a result, two different issuers that emit the same subject value map to the same local account.\n\nAn attacker who can obtain a valid token from one trusted issuer with a `sub` matching a victim registered under a different issuer can authenticate as that victim and access their account.\n\nThis issue only affects instances where the token exchange feature is enabled and more than one trusted external issuer is configured.\n\n## Patches\nThe issue has been fixed in n8n version 2.28.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- If multiple trusted issuers are not required, reduce the token exchange configuration to a single trusted issuer.\n- Disable the token exchange feature entirely if it is not in active use.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","public_affected_ranges":["< 2.27.4"]}],"null_published_at":"2026-11-08T19:53:44.055Z","source_updated_at":"2026-07-22T21:59:17.000Z","source_disclosed_at":"2026-07-22T21:59:15.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-03T17:42:43.803Z"},{"id":"NVI-00016101","kind":"vulnerability","title":"n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mq3m-f8x3-579w","CVE-2026-59208"],"plain_summary":"GitHub lists this reviewed advisory for n8n, n8n. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-21ac352fce6c2ed63ea117a64eac0bdb"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-21ac352fce6c2ed63ea117a64eac0bdb","url":"https://github.com/advisories/GHSA-mq3m-f8x3-579w","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-mq3m-f8x3-579w","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T17:42:43.803Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-21ac352fce6c2ed63ea117a64eac0bdb"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nWhen an n8n instance is configured with more than one trusted token-exchange issuer, external identities are resolved to local accounts using only the JWT `sub` claim, ignoring the issuer (`iss`). As a result, two different issuers that emit the same subject value map to the same local account.\n\nAn attacker who can obtain a valid token from one trusted issuer with a `sub` matching a victim registered under a different issuer can authenticate as that victim and access their account.\n\nThis issue only affects instances where the token exchange feature is enabled and more than one trusted external issuer is configured.\n\n## Patches\nThe issue has been fixed in n8n version 2.28.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- If multiple trusted issuers are not required, reduce the token exchange configuration to a single trusted issuer.\n- Disable the token exchange feature entirely if it is not in active use.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","public_affected_ranges":[">= 2.28.0, < 2.28.1"]},{"certainty":"source_listed","source_ids":["sr-21ac352fce6c2ed63ea117a64eac0bdb"],"technology":"n8n","known_exclusions":[],"conditions_summary":"## Impact\nWhen an n8n instance is configured with more than one trusted token-exchange issuer, external identities are resolved to local accounts using only the JWT `sub` claim, ignoring the issuer (`iss`). As a result, two different issuers that emit the same subject value map to the same local account.\n\nAn attacker who can obtain a valid token from one trusted issuer with a `sub` matching a victim registered under a different issuer can authenticate as that victim and access their account.\n\nThis issue only affects instances where the token exchange feature is enabled and more than one trusted external issuer is configured.\n\n## Patches\nThe issue has been fixed in n8n version 2.28.1. Users should upgrade to this version or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- If multiple trusted issuers are not required, reduce the token exchange configuration to a single trusted issuer.\n- Disable the token exchange feature entirely if it is not in active use.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","public_affected_ranges":["< 2.27.4"]}],"null_published_at":"2026-11-04T10:04:27.891Z","source_updated_at":"2026-07-22T21:59:17.000Z","source_disclosed_at":"2026-07-22T21:59:15.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T17:42:43.803Z"}],"next_cursor":null,"snapshot_revision":"42594"}