{"schema":"threatline.record/2","record":{"id":"GHSA-3qcw-p65v-c7vq","aliases":["GHSA-3qcw-p65v-c7vq"],"summary":"Unauthenticated Unbounded OAuth Client Persistence via the Authorize Endpoint","details":"## Impact\n\nThe unauthenticated authorization endpoint resolved a client by URL path but stored the caller's raw identifier as the row key, so values differing only in their query string each created a new record. Those records were marked first-party, the flag the registration cap excludes, and no size limit, expiry or deletion path applied. A caller with no account can grow that table without bound until the disk fills, and the rows outlive the resource they name.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict network access to the n8n instance to trusted users and systems only.\n- Deactivate or reconfigure any workflows using Form Trigger or Chat Trigger nodes with `n8nUserAuth` authentication until the instance is patched.\n- Monitor database size for unexpected growth and set filesystem-level disk usage alerts.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-3qcw-p65v-c7vq","source_modified_at":"2026-09-30T08:35:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.42.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-3qcw-p65v-c7vq","source_modified_at":"2026-09-30T08:35:09Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.41.4"}],"fixed_versions":[],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-30T08:35:09Z","modified_at":"2026-09-30T08:35:09Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-3qcw-p65v-c7vq","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T08:35:09Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T08:35:09Z","content_hash":"d0cee29bde268721bc471f664e0f17cd792731f9a76d8c3bed450e15a1d737c1"}}