{"schema":"threatline.record/2","record":{"id":"GHSA-426f-xmcv-g8pg","aliases":["GHSA-426f-xmcv-g8pg"],"summary":"OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback","details":"## Impact\n\nThe OAuth2 credential callback did not require the browser completing the dynamic-credential connect flow to be authenticated as the user who started it. A member with access to a resolvable OAuth2 credential could send the provider authorization URL to another person. If that person completed the consent without an active n8n session, their provider tokens were stored under the member's identity, and the member's workflows could then act as the victim at the OAuth provider.\n\nThis affects Enterprise instances with resolvable OAuth2 credentials configured.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.46.1, 2.45.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Set `N8N_OAUTH_BROWSER_BINDING=true` to enforce browser-session binding on OAuth callbacks.\n- Restrict n8n instance access to fully trusted users only.\n- Audit team project memberships and remove editor access from any users who are not fully trusted.\n- Disable the dynamic credentials feature if it is not required.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","source_modified_at":"2026-10-28T08:48:31Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.46.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","source_modified_at":"2026-10-28T08:48:31Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.45.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","source_modified_at":"2026-10-28T08:48:31Z","fetched_at":"2026-10-28T15:55:58.673066Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 3.0.1"}],"fixed_versions":[],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T08:48:31Z","modified_at":"2026-10-28T08:48:31Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg","fetched_at":"2026-10-28T15:55:58.673066Z","source_modified_at":"2026-10-28T08:48:31Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T08:48:31Z","content_hash":"e198cbccd1d8c54d7077ea38a932a6aa1869d654bd3d93a3829e8682c18df0c6"}}