An authentication bypass flaw in n8n’s Stripe Trigger node permits an unauthenticated user to simulate Stripe webhook events. Because incoming webhook requests are not verified against a stored signing secret, any HTTP client that knows the webhook’s endpoint can POST a fabricated event, causing the associated workflow to run as if a legitimate Stripe notification had been received. The flaw is an instance of authentication bypass (CWE‑290) and can be used to feign payment or subscription actions, potentially altering downstream workflow flows.

The vulnerability affects n8n versions from 0.150.0 through 2.2.1, inclusive. Any deployment running one or more active workflows that incorporate a Stripe Trigger node before the 2.2.2 release is susceptible, regardless of whether the webhook URL is protected. Although the URL contains a high‑entropy UUID, it is viewable to any authenticated user who can access the workflow, thereby reducing practical barriers for an attacker.

The CVSS base score of 6.5 indicates a moderate level of risk, and the EPSS score of less than 1 percent suggests a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires simply knowing the webhook URL and sending a POST request that mimics a valid Stripe event type; no software exploits or privileged access are required. Because no verification of the Stripe signature occurs, a crafted request will be accepted and the workflow executed under the privileges of the deployment.