OAuth Callback Vulnerability in n8n Workflow Automation Platform

CVE-2026-33720

What is CVE-2026-33720?

The n8n workflow automation platform has a significant vulnerability that arises when the environment variable N8N_SKIP_AUTH_ON_OAUTH_CALLBACK is set to true. This configuration skips crucial ownership verification of the OAuth state parameter, enabling an attacker to manipulate the OAuth flow. Unsuspecting victims can be led to complete an OAuth process against a credential object owned by the attacker. As a result, the victim's OAuth tokens can be compromised and stored in the attacker's environment, allowing unauthorized execution of workflows under the victim's account. It is vital that users upgrade to n8n version 2.8.0 or later to address this issue. In cases where immediate upgrades are not feasible, users should exercise caution by limiting access to trusted individuals and refraining from enabling the N8N_SKIP_AUTH_ON_OAUTH_CALLBACK setting unless absolutely necessary. These precautions serve as temporary solutions while the full remediation is underway.

References