Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD4.8 Medium

CVE-2026-56359

n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n n8n

Default version status: unaffected

  • 2.7.0 to < 2.8.0affected
  • 2.8.0unaffected
pkg:npm/n8n

n8n n8n

Default version status: unaffected

  • 0 to < 2.6.4affected
  • 2.6.4unaffected
pkg:npm/n8n

References