n8n: OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback

Impact

The OAuth2 credential callback did not require the browser completing the dynamic-credential connect flow to be authenticated as the user who started it. A member with access to a resolvable OAuth2 credential could send the provider authorization URL to another person. If that person completed the consent without an active n8n session, their provider tokens were stored under the member's identity, and the member's workflows could then act as the victim at the OAuth provider.

This affects Enterprise instances with resolvable OAuth2 credentials configured.

Patches

The issue has been fixed in n8n versions 2.46.1, 2.45.5 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Set N8N_OAUTH_BROWSER_BINDING=true to enforce browser-session binding on OAuth callbacks.
• Restrict n8n instance access to fully trusted users only.
• Audit team project memberships and remove editor access from any users who are not fully trusted.
• Disable the dynamic credentials feature if it is not required.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.