n8n token exchange flaw could let attackers log in as other users

A vulnerability in the workflow automation platform n8n could let an attacker log in as another user without their password. Tracked as CVE-2026-59208, the flaw sits in n8n's Enterprise token exchange feature, which lets embedded deployments avoid a second login by accepting tokens from partner identity providers. Because the code did not properly bind an identity to its issuer, a valid token from one issuer that carried the identifier of a user under a different issuer would log the attacker in as that user. n8n shipped a fix on June 24, and there is no evidence of exploitation. The bug was found by an AI penetration-testing agent.

Check

Check whether you run n8n, especially Enterprise deployments using the token exchange feature for embedding or single sign-on, confirm the version, and update to a release that includes the June fix.

Affected

Organizations running n8n Enterprise deployments that use the token exchange feature (CVE-2026-59208); a flaw in binding identities to issuers could let an attacker present a token and log in as another user.

Fix

Update n8n to a version containing the June 24 fix, review authentication logs for unexpected cross-issuer logins, and apply least privilege so that a single compromised account has limited reach.