The flaw is an authentication bypass in n8n’s Chat Trigger node when users employ the n8n User Auth configuration. A request to the Chat Trigger webhook endpoint can reach the node without the expected credential verification, allowing an attacker to trigger automation workflows without permission. This bypass is a CWE‑287 weakness and permits the adversary to execute arbitrary actions defined by the node, potentially compromising data and process integrity.

n8n: n8n is affected. All releases before 1.123.22, the 2.0.0 through 2.9.2 series, and 2.10.0 contain the vulnerability. The issue is fixed in 1.123.22, 2.9.3, and 2.10.1.

The CVSS score of 6.3 indicates moderate severity. EPSS is less than 1% and the vulnerability is not listed in CISA KEV, suggesting a low likelihood of widespread exploitation. The attack vector is inferred to be a simple unauthenticated HTTP request to the webhook endpoint, which an attacker can invoke remotely if the node is exposed to the Internet.