n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authorize endpoint. The endpoint resolves clients by URL path but stores the caller's raw identifier as the record key, allowing attackers to send identifiers differing only in their query string. This ability permits unlimited creation of first‑party client records, bypassing the registration cap and enabling the database to grow until the disk fills, resulting in a denial of service. The weakness is a resource exhaustion flaw (CWE‑770).

The vulnerability affects the n8n workflow automation platform from n8n‑io, specifically all versions older than 2.41.4 and 2.42.1.

The CVSS score of 8.2 indicates a high severity; the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack vector is unauthenticated via the OAuth authorize endpoint, meaning an attacker only needs network access to the exposed endpoint. The lack of authentication and the ability to create unlimited records give the attacker significant impact potential, and the flaw can be leveraged without special permissions or elevated privileges. Consequently, the risk is high and the vulnerability is likely exploitable in practice.