The vulnerability arises when n8n resolves external identities solely by the JWT sub claim while ignoring the issuer (iss) claim when multiple trusted token‑exchange issuers are configured. This incorrect authentication handling (CWE‑287) allows an attacker who can obtain a token from one trusted issuer to authenticate as a victim whose sub matches the account under a different issuer. The flaw is a form of incomplete issuer validation (CWE‑346).

n8n‑io n8n instances that are running any version older than 2.27.4 or any version older than 2.28.1 and that have two or more trusted token‑exchange issuers configured are vulnerable. Upgrades to 2.27.4 or 2.28.1 and later contain the fix.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1% shows a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an adversary obtaining a valid JWT issued by a trusted issuer and using a sub value that matches a victim under another issuer, thereby bypassing authentication and gaining account takeover. If the attacker can forge or intercept a trusted token, they can exploit the flaw to impersonate a user.