CVE-2026-72772
n8n before 2.32.1 Authentication Bypass via Token Exchange
Description
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
INFO
Published Date :
Aug. 11, 2026, 1:19 p.m.
Last Modified :
Oct. 24, 2026, 3:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | HIGH | [email protected] |
Solution
- Update n8n to version 2.32.1 or later.
- Disable embed login if not required.
- Review trusted key configurations.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-72772.
| URL | Resource |
|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr | Mitigation Vendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-token-exchange | Third Party Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-72772 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-72772
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-72772 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-72772 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 24, 2026
Action Type Old Value New Value Changed Translation Title: n8n de n8n-io, Description: n8n anterior a 2.32.1 (y anterior a 2.31.5) es vulnerable a la toma de control de cuenta a través de la función de inicio de sesión incrustado de intercambio de tokens. Cuando un token entrante válidamente firmado se emparejaba con una cuenta local por su declaración de correo electrónico, el servicio no verificaba que la declaración de correo electrónico estuviera verificada, ni que el techo de rol permitido de la clave de confianza cubriera esa cuenta. Como resultado, cualquiera que pudiera obtener un token aceptado por una clave de confianza configurada (por ejemplo, un emisor de confianza que emitiera direcciones de correo electrónico no verificadas) podría autenticarse como cualquier usuario existente y obtener control total de la cuenta. Este problema solo afecta a las instancias donde la función de inicio de sesión incrustado está habilitada y al menos una fuente de clave de confianza está configurada. Title: n8n de n8n-io, Description: n8n anterior a 2.32.1 (y anterior a 2.31.5) es vulnerable a la toma de control de cuenta a través de la función de inicio de sesión incrustado de intercambio de tokens. Cuando un token entrante válidamente firmado se emparejaba con una cuenta local por su declaración de correo electrónico, el servicio no verificaba que la declaración de correo electrónico estuviera verificada, ni que el techo de rol permitido de la clave de confianza cubriera esa cuenta. Como resultado, cualquiera que pudiera obtener un token aceptado por una clave de confianza configurada (por ejemplo, un emisor de confianza que emitiera direcciones de correo electrónico no verificadas) podría autenticarse como cualquier usuario existente y obtener control total de la cuenta. Este problema solo afecta a las instancias donde la función de inicio de sesión incrustado está habilitada y al menos una fuente de clave de confianza está configurada. -
CVE Translated by [email protected]
Oct. 23, 2026
Action Type Old Value New Value Added Translation Title: n8n de n8n-io, Description: n8n anterior a 2.32.1 (y anterior a 2.31.5) es vulnerable a la toma de control de cuenta a través de la función de inicio de sesión incrustado de intercambio de tokens. Cuando un token entrante válidamente firmado se emparejaba con una cuenta local por su declaración de correo electrónico, el servicio no verificaba que la declaración de correo electrónico estuviera verificada, ni que el techo de rol permitido de la clave de confianza cubriera esa cuenta. Como resultado, cualquiera que pudiera obtener un token aceptado por una clave de confianza configurada (por ejemplo, un emisor de confianza que emitiera direcciones de correo electrónico no verificadas) podría autenticarse como cualquier usuario existente y obtener control total de la cuenta. Este problema solo afecta a las instancias donde la función de inicio de sesión incrustado está habilitada y al menos una fuente de clave de confianza está configurada. -
Initial Analysis by [email protected]
Sep. 18, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CPE Configuration OR *cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* versions up to (excluding) 2.31.5 *cpe:2.3:a:n8n:n8n:2.32.0:*:*:*:*:node.js:*:* Added Reference Type VulnCheck: https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr Types: Mitigation, Vendor Advisory Added Reference Type VulnCheck: https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-token-exchange Types: Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 11, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-72772', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-08-11T14:57:25.769099Z'} -
New CVE Received by [email protected]
Aug. 11, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'n8n-io', 'product': 'n8n', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.32.1', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '2.32.1', 'versionType': 'semver'}], 'packageURL': 'pkg:npm/n8n', 'defaultStatus': 'unaffected'}, {'vendor': 'n8n-io', 'product': 'n8n', 'versions': [{'status': 'affected', 'version': '0', 'lessThan': '2.31.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '2.31.5', 'versionType': 'semver'}], 'packageURL': 'pkg:npm/n8n', 'defaultStatus': 'unaffected'}] Added Description n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured. Added CVSS V4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-640 Added Reference https://github.com/n8n-io/n8n/security/advisories/GHSA-8342-988q-86cr Added Reference https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-token-exchange