n8n before version 1.123.15 and 2.5.0 has a missing HMAC‑SHA256 signature check in its GitHub Webhook Trigger node. Attackers who can obtain the public webhook URL can forge POST requests that the system treats as authentic GitHub events, causing arbitrary workflows to run with the supplied payload. This flaw allows an attacker to execute arbitrary code or capture data that the workflow is permitted to handle, representing a breach of confidentiality, integrity, or availability.

The vulnerability affects installations of the n8n automation platform prior to release 1.123.15 or 2.5.0. Any instance exposing a GitHub webhook trigger endpoint that does not enforce HMAC verification is susceptible.

The CVSS v3 score of 6.3 indicates a medium severity vulnerability. Because the attack vector is remote and requires only knowledge of the publicly exposed webhook URL, the risk of exploitation is non‑trivial. EPSS does not provide a probability, and the issue is not listed in the CISA KEV catalog, but the lack of cryptographic validation (CWE‑290) makes the vulnerability a likely target for attackers willing to reach an exposed n8n instance.