A malicious OAuth client can be registered without authentication, and if a user authorizes this client the system renders an arbitrary JavaScript payload in a toast notification. When a second user revokes the client, clicking the notification executes the script in the victim’s authenticated browser session, allowing the attacker to steal credentials, hijack sessions, manipulate workflow definitions, or elevate privileges. The flaw is a classic cross‑site scripting vulnerability.

This issue affects n8n-io’s n8n product versions prior to 1.123.32, 2.17.4, and 2.18.1.

With a CVSS score of 8.8 the vulnerability presents a high severity. Because an unauthenticated user can register a client and a legitimate user must authorize it, the attack requires social engineering of the consent dialog or an insider revocation event. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS and the potential for arbitrary code execution warrant urgent consideration.