CVE-2026-86084: n8n Workflow Automation Auth Bypass Vulnerability

CVE-2026-86084 Overview

CVE-2026-86084 is an authentication bypass vulnerability in n8n, an open source workflow automation platform. The public OpenID Connect (OIDC) login and callback endpoints completed authentication even when OIDC was not the active authentication method. Enterprise administrators who configured and later disabled an identity provider still exposed a working route capable of issuing valid sessions. An attacker with knowledge of a previously configured OIDC provider could obtain authenticated sessions and access the workflow platform. The issue is tracked as [CWE-288: Authentication Bypass Using an Alternate Path or Channel] and is fixed in versions 1.123.76, 2.37.7, and 2.38.2.

Critical Impact

Attackers can complete OIDC authentication against n8n instances where the provider was configured but disabled, bypassing the active authentication method and obtaining valid sessions.

Affected Products

• n8n versions prior to 1.123.76
• n8n versions prior to 2.37.7
• n8n versions prior to 2.38.2 (Enterprise deployments with previously configured OIDC)

Discovery Timeline

• 2026-09-08 - CVE-2026-86084 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86084

Vulnerability Analysis

The vulnerability resides in packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, specifically in the generateLoginUrl function and the OIDC callback flow. Both code paths lacked an assertOidcLoginEnabled guard. As a result, the OIDC endpoints processed authentication requests without verifying that OIDC was the currently active single sign-on method.

Enterprise administrators who previously enabled OIDC, configured an identity provider, and then disabled OIDC did not fully remove the attack surface. The public login and callback routes remained reachable and, when driven with a valid OIDC response, issued a legitimate n8n session. This allowed authentication paths outside of the enabled method to grant access to protected workflows, credentials, and configuration.

Root Cause

The root cause is missing authorization enforcement on the OIDC login and callback handlers. The assertOidcLoginEnabled check was applied inconsistently, so disabling OIDC in the administrative interface did not invalidate the underlying route. This is a classic alternate-path authentication bypass consistent with [CWE-288].

Attack Vector

Exploitation requires network access to the n8n instance and knowledge of the previously configured OIDC provider. An attacker with limited privileges on the identity provider can initiate the login flow, receive a callback, and obtain a valid session cookie for n8n. No user interaction on the victim side is required to trigger the vulnerable route. Refer to the GitHub Security Advisory GHSA-pf83-w3f9-8m37 for the full technical write-up.

Detection Methods for CVE-2026-86084

Indicators of Compromise

• Successful authentication events originating from OIDC callback endpoints when the administrative UI shows OIDC as disabled.
• Session issuance for users that do not exist in the primary directory used by the currently enabled authentication method.
• Unexpected requests to /rest/sso/oidc/login or the OIDC callback route on instances that have decommissioned OIDC.

Detection Strategies

• Review n8n audit logs for authentication events attributed to the OIDC provider after OIDC was administratively disabled.
• Correlate identity provider sign-in telemetry with n8n session creation events to spot logins that bypass the active method.
• Alert on any HTTP traffic to OIDC login or callback paths on n8n hosts running unpatched versions.

Monitoring Recommendations

• Enable verbose authentication logging on n8n and forward events to a centralized SIEM for retention and correlation.
• Monitor for creation of new administrative or workflow-owner accounts and unusual credential access following authentication events.
• Track outbound calls from workflows for signs of post-authentication abuse, such as data exfiltration through webhook nodes.

How to Mitigate CVE-2026-86084

Immediate Actions Required

• Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 depending on the deployed release channel.
• Rotate any n8n session secrets and invalidate existing sessions after upgrading.
• Audit accounts and workflows for changes made through OIDC-authenticated sessions during the exposure window.

Patch Information

The issue is fixed in n8n 1.123.76, 2.37.7, and 2.38.2. The fix adds the assertOidcLoginEnabled guard to both generateLoginUrl and the callback handler in packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, ensuring that OIDC endpoints reject requests when OIDC is not the active authentication method.

Workarounds

• Restrict network access to n8n management endpoints so that only trusted administrators can reach the OIDC routes until patching is complete.
• Remove OIDC configuration entries entirely, rather than only toggling OIDC off, on affected versions.
• Place n8n behind a reverse proxy that blocks requests to /rest/sso/oidc/* paths when OIDC is not in use.

# Example reverse proxy rule to block OIDC endpoints when OIDC is disabled
location ~ ^/rest/sso/oidc/ {
    return 403;
}