CVE-2026-72772: n8n Auth Bypass Vulnerability

CVE-2026-72772 Overview

CVE-2026-72772 is an authentication bypass vulnerability in n8n, the workflow automation platform, affecting versions before 2.32.1 and before 2.31.5. The flaw resides in the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, n8n failed to verify that the email claim was marked as verified. It also failed to check that the trusted key's permitted role ceiling covered the target account. An attacker who can obtain a token accepted by any configured trusted key can authenticate as any existing user and gain full account control.

Critical Impact
Any actor able to mint or acquire a token from a configured trusted issuer that emits unverified email claims can impersonate arbitrary n8n users, including administrators, and take over their workflows and credentials.

Affected Products

n8n versions prior to 2.32.1
n8n versions prior to 2.31.5 on the 2.31.x branch
n8n instances with Embed Login enabled and at least one trusted key source configured

Discovery Timeline

2026-08-11 - CVE-2026-72772 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72772

Vulnerability Analysis

The vulnerability is classified under [CWE-640: Weak Password Recovery Mechanism for Forgotten Password], reflecting broken trust decisions during identity assertion handling. The Token Exchange Embed Login flow accepts a signed token from a trusted issuer, extracts the email claim, and maps that email to an existing local n8n account. The service issues an authenticated session for the matched user once the signature validates.

Two checks are missing from the login path. First, n8n does not require the email_verified claim to be true before treating the email as an authoritative identifier. Second, n8n does not enforce that the trusted key's role ceiling includes the target account's role. As a result, a token signed by any configured trusted issuer can identify any user by email regardless of that issuer's assurance level or intended scope.

Root Cause

The root cause is missing validation of identity claim assurance and missing role-scope enforcement in the trusted key model. n8n treats a valid signature as sufficient proof of identity for the address contained in the token. Trusted issuers that emit unverified email addresses, or that are intended to represent a limited user population, are implicitly promoted to full identity providers for the entire user directory.

Attack Vector

An attacker registers or controls an account at a trusted issuer that permits unverified email addresses on outbound tokens. The attacker sets the email address on that identity to the address of a target n8n user, typically an administrator. The attacker requests a token from the trusted issuer and submits it to the n8n Embed Login endpoint. n8n validates the signature, matches the email to the administrator account, and returns an authenticated session. The attacker then reads workflow credentials, executes workflows, and pivots to connected systems. Exploitation requires network access to the n8n instance and a token from any configured trusted key.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-8342-988q-86cr and the VulnCheck Advisory for vendor technical details.

Detection Methods for CVE-2026-72772

Indicators of Compromise

Successful Embed Login events for administrator or high-privilege accounts originating from unusual client IP addresses or user agents.
Authentication events where the incoming token's issuer differs from the primary identity provider used by human users.
New or modified workflows, credential objects, or API keys created shortly after an Embed Login session for a privileged user.
Sessions established for users who normally authenticate through a different mechanism, such as SSO or local password.

Detection Strategies

Correlate Embed Login authentication events with the email_verified claim value in the presented token, and flag any successful login where the claim is false or absent.
Alert on any Embed Login session that authenticates a user whose role exceeds the configured role ceiling of the trusted key used.
Baseline the set of email domains that legitimately authenticate through each trusted key, and alert on tokens outside that baseline.

Monitoring Recommendations

Forward n8n audit logs and authentication logs to a central analytics platform and retain them for at least 90 days.
Monitor for privilege changes, credential exports, and workflow modifications following any Embed Login session on versions prior to 2.32.1 and 2.31.5.
Track outbound connections initiated by n8n workflows for signs of data exfiltration after suspicious logins.

How to Mitigate CVE-2026-72772

Immediate Actions Required

Upgrade n8n to version 2.32.1 or later on the 2.32.x branch, or to 2.31.5 or later on the 2.31.x branch.
Audit all configured trusted key sources and remove any issuer that emits unverified email claims or is not intended to authenticate n8n users.
Rotate credentials stored in n8n workflows and invalidate active sessions for administrator accounts if compromise is suspected.
Review recent authentication and workflow-modification logs for signs of impersonation.

Patch Information

n8n has released fixed versions 2.32.1 and 2.31.5 that enforce the email_verified claim on incoming tokens and validate the trusted key's role ceiling against the target account. Refer to the GitHub Security Advisory GHSA-8342-988q-86cr for release notes and patch commits.

Workarounds

Disable the Embed Login feature on affected instances until the upgrade is applied.
Remove all trusted key sources from the n8n configuration if Embed Login cannot be disabled.
Restrict network access to the n8n authentication endpoints to trusted networks using firewall or reverse-proxy rules.
Require multi-factor authentication on the upstream identity provider so that stolen or forged tokens alone cannot complete login.