Authorization Code Mismanagement in n8n Workflow Automation Platform
CVE-2026-86073
5.9MEDIUM
What is CVE-2026-86073?
n8n is a popular open-source workflow automation platform that, prior to versions 2.37.7 and 2.38.1, encountered a vulnerability in its OAuth token handling. Specifically, while the OAuth token endpoint successfully bounded an authorization code's initial access token to the approved resource, it failed to enforce the same binding for its refresh token. Consequently, this oversight allowed a malicious actor to exploit the refresh mechanism by substituting an approved workflow URL with an unapproved one, thereby obtaining valid tokens for unauthorized workflows. This vulnerability has been addressed in the aforementioned versions, enhancing the integrity of the OAuth process.
Affected Version(s)
n8n < 2.37.7 < 2.37.7
n8n >= 2.38.0, < 2.38.1 < 2.38.0, 2.38.1