A misconfiguration that enables an attacker to bypass ownership verification during the OAuth callback leads to the attacker receiving OAuth tokens that belong to the victim. The attacker can then store those tokens as their own credentials and execute workflows on the victim’s instance, effectively gaining authorized control over the victim’s workflow environment. This vulnerability represents a significant compromise of integrity and authorization, classified under CWE-863.

The flaw affects n8n-io n8n versions earlier than 2.8.0 when the environment variable N8N_SKIP_AUTH_ON_OAUTH_CALLBACK is set to true. It does not apply to versions 2.8.0 and later, nor to instances where the variable is not enabled.

The CVSS score of 6.3 indicates medium severity, while the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker requires that the environment variable be enabled and must lure a legitimate user to complete an OAuth flow targeted at the attacker’s credential. Once the flow succeeds, the attacker can use the compromised tokens to trigger workflows on the victim’s behalf. This scenario is possible in typical web application contexts but would be mitigated by disabling the variable or restricting access to trusted administrators.