An attacker who possesses a workflow execution's resume token can exploit a signature bypass in the waiting‑webhook endpoint. The flaw causes the system to validate the signature before normalising an alternate node reference, allowing the attacker to approve waiting executions that belong to other users. Upon approval the workflow proceeds under the original owner's credentials, giving the attacker the same authority and enabling the execution of downstream actions, including arbitrary command execution. This vulnerability is classified as CWE‑180, reflecting the improper handling of authorization data during request validation.

The vulnerability exists in the n8n workflow automation platform for versions released before 2.41.4 and before 2.42.1. Users running any n8n release older than those thresholds are affected, regardless of whether they host a public or private instance.

With a CVSS score of 7.0 the flaw is moderately high severity. While EPSS data is not available, the lack of a recognized exploit in CISA KEV does not diminish the risk: an attacker who can intercept or guess a resume token—such as via insider knowledge or a separate breach—can authorize privileged executions without additional proof. possession of a valid resume token, and mitigation requires preventing token disclosure and patching the system.