Listen to this Post
CVE-2026-86084 is an authentication bypass vulnerability affecting n8n, an open-source workflow automation platform. The flaw resides in the enterprise edition’s OIDC (OpenID Connect) single sign-on implementation, specifically within the file packages/cli/src/modules/sso-oidc/oidc.service.ee.ts. The core issue is that the public OIDC login and callback endpoints execute the complete authentication flow regardless of whether OIDC is currently configured as the instance’s active, enabled authentication method. When an administrator configures an OIDC identity provider and subsequently disables it via the settings, the underlying routes remain active and functional. This occurs because the functions `generateLoginUrl` and the callback flow lack a critical assertion check—specifically assertOidcLoginEnabled—that would verify the OIDC login enablement status before proceeding with session generation. An attacker with network access to the n8n instance URL can initiate or complete an authentication sequence through these dormant but accessible OIDC endpoints. By interacting directly with the OIDC callback endpoint, the attacker can obtain valid session tokens without proper authorization from the currently enabled authentication mechanism. This effectively bypasses primary authentication methods such as local password login or other configured identity providers. The vulnerability aligns with CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and maps to MITRE ATT&CK technique T1078 (Valid Accounts). The issue affects n8n Enterprise instances where OIDC was configured at least once and subsequently disabled. The patch requires OIDC to be the enabled, active authentication method before either endpoint starts the flow or issues a session. The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. The operational impact is severe as it nullifies access control measures intended by system administrators, potentially leading to unauthorized access, data exfiltration, manipulation of workflow automation logic, and compromise of connected systems that rely on authenticated sessions within the platform. The CVSS v4.0 score is 6, with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N.
DailyCVE Form:
Platform: n8n
Version: < 1.123.76, >= 2.0.0, < 2.37.7, >= 2.38.0, < 2.38.2
Vulnerability: Authentication Bypass
Severity: Moderate
date: Sep 2, 2026
Prediction: Already patched (Sep 2026)
What Undercode Say:
Analytics:
curl -X GET "https://target-n8n-instance.com/rest/sso/oidc/login" -c cookies.txt
curl -X GET "https://target-n8n-instance.com/rest/sso/oidc/callback?code=AUTH_CODE&state=STATE" -b cookies.txt -c session.txt
// Vulnerable logic in oidc.service.ee.ts (simplified)
async generateLoginUrl() {
// Missing assertOidcLoginEnabled() check
return this.oidcClient.getAuthorizationUrl();
}
async callback(req, res) {
// Missing assertOidcLoginEnabled() check
const tokens = await this.oidcClient.getTokens(req.query.code);
const session = await this.createSession(tokens);
return res.json(session);
}
Exploit: (Educational Purposes!)
An attacker identifies an n8n Enterprise instance where OIDC was previously configured and then disabled. They send a request to the OIDC login endpoint to initiate the authentication flow. After completing the flow with a controlled identity provider, the callback endpoint issues a valid session token despite OIDC being disabled.
Protection: from this CVE
Upgrade to n8n version 1.123.76, 2.37.7, or 2.38.2 or later. If upgrading is not immediately possible, disable or revoke the corresponding application or client at the IdP level to prevent the OIDC flow from completing. Restrict network-level access to the n8n instance to trusted users only.
Impact:
Unauthorized access to the n8n environment, data exfiltration, manipulation of workflow automation logic, and compromise of connected systems relying on authenticated sessions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
