Description
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| n8n | n8n | < 2.8.0 | 2.8.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | n8n | < 2.8.0 | 2.8.0 | GHSA-vjf3-2gpj-233v |
Advisories 2
- NCSC-2026-0248 Kwetsbaarheden verholpen in n8n workflow automation platform NCSC-NL (Netherlands) · Jul 17, 2026
- WID-SEC-2026-0532 n8n: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2026
References
- GitHub Security Advisory (GHSA-vjf3-2gpj-233v) vendor-advisory
- VulnCheck Advisory: n8n - SSO Enforcement Bypass via API third-party-advisory