Open Source Workflow Automation Platform n8n Exposed Due to Misconfigured OIDC Authentication
CVE-2026-86084
What is CVE-2026-86084?
The n8n open source workflow automation platform suffers from an authentication bypass vulnerability affecting its OIDC login and callback endpoints. Prior to versions 1.123.76, 2.37.7, and 2.38.2, administrators who disabled their OIDC identity provider left open routes that could allow unauthorized issuance of valid sessions. This flaw in the logic, specifically the lack of an assertion that OIDC login is enabled, means that the authentication process would incorrectly complete. The issue affects both the generateLoginUrl and callback flow. It is crucial for users to upgrade to the patched versions to mitigate this security risk. For fixes, refer to the releases linked in the references.
Affected Version(s)
n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2
n8n >= 2.0.0, < 2.37.7 < 2.0.0, 2.37.7
n8n < 1.123.76 < 1.123.76