n8n, the workflow automation platform, has patched a security vulnerability in its Enterprise edition that could have allowed attackers to authenticate as other users. The flaw affected instances configured to trust multiple external token issuers, where the system matched incoming JWTs to local users based solely on the sub claim while ignoring the iss field.
The vulnerability meant that a valid token from one identity provider carrying a sub value that belonged to a user under a different provider would grant the attacker access to that user’s account. This cross-tenant authentication bypass could allow an attacker with a valid token from one issuer to impersonate any user whose identifier happened to overlap across the trusted issuers.
n8n Enterprise customers who have configured their instances to accept authentication tokens from more than one external provider were affected. The platform’s self-hosted nature means that administrators need to apply the security update to their own deployments rather than relying on a centrally managed fix.
The flaw was discovered by security researchers and reported to n8n through coordinated disclosure. n8n released a patch addressing the issue and advised all Enterprise customers to update their installations. The company also recommended that administrators review their authentication configurations and ensure that the iss claim is properly validated for all incoming tokens.
