The vulnerability exists in n8n's Token Exchange Embed Login feature, where the system accepts a signed JWT, matches the token's email claim to an existing user, yet does not verify whether that email address has been confirmed or whether the trusted key's permitted role ceiling safeguards the account. This flaw permits an attacker who can obtain a token accepted by a trusted key—such as a malicious or misconfigured issuer generating unverified emails—to authenticate as any local user and gain full control of the instance. The flaw is a classic example of Authorization Bypass via User‑Controlled Key, listed as CWE‑640.

n8n provided by n8n‑io, versions prior to 2.32.1, including all releases up through 2.31.5, is affected when the Embed Login feature is enabled and at least one trusted key source is configured. The vulnerability does not apply to versions 2.32.1 or newer.

With a CVSS score of 8.9 the vulnerability is rated high severity. The EPSS score is not available, and it is not currently listed in the CISA KEV catalog, but the lack of a verified email check and role ceiling control makes remote exploitation straightforward for anyone able to generate or intercept a suitable token. Likely attacks would involve sending a crafted or accepted JWT to the token‑exchange endpoint from an external network, thereby bypassing authentication. Because this flaw effectively allows full account takeover, the risk to any environment running the affected versions is significant.