n8n Token Exchange Flaw CVE-2026-59208 Enables Account Takeover via JWT Sub Claim Mismatch

A critical vulnerability in n8n’s Enterprise token exchange feature, tracked as CVE-2026-59208, allows attackers to log in as any user by exploiting a missing issuer validation in JWT handling. The flaw affects n8n releases below 2.27.4 and version 2.28.0, patched in versions 2.27.4 and 2.28.1.

n8n, a workflow automation platform, implemented token exchange per RFC 8693 for OEM partners to enable single sign-on. The feature trusts external token issuers configured via N8N_TOKEN_EXCHANGE_TRUSTED_KEYS. The vulnerability arises because n8n matches incoming JWTs to local accounts solely on the ‘sub’ claim, ignoring the ‘iss’ claim. This allows a valid token from one issuer with a ‘sub’ value that coincidentally matches a user under a different issuer to authenticate as that user without a password.

The flaw was reported by GitHub user bearsyankees, associated with Strix, an AI penetration testing firm. GitHub assigned CVE-2026-59208 with a CVSS 4.0 score of 7.6 (high), while NVD rates it 6.8 on CVSS 3.1 (medium). CISA’s SSVC assessment reports no exploitation as of July 13, 2026. The vulnerability only impacts Enterprise instances with token exchange enabled and at least two trusted external issuers, limiting exposure to specific OEM deployments.

n8n released fixes on June 24, 2026, but the CVE went public on July 9. The advisory recommends patching to versions 2.27.4 or 2.28.1, or temporarily reducing trusted issuers to one or disabling token exchange. A related earlier flaw, CVE-2026-54305, allowed authenticated users to overwrite others’ OAuth tokens via Dynamic Credentials endpoints.