n8n: token exchange flaw could expose a different account

Colleagues, I’d like to draw attention to a cybersecurity vulnerability in n8n.

In Enterprise token exchange, the platform validated JWTs only by sub and did not check iss. If multiple external issuers were trusted in the configuration, a token from one issuer could grant access to an account tied to another.

The issue affects versions below 2.27.4 and 2.28.0. Fixes are available in 2.27.4 and 2.28.1.

If an immediate upgrade is not possible, I would narrow the trusted issuer list or temporarily disable token exchange.

Why it matters: the flaw strikes at the core of authentication and may lead to account takeover.

How do you validate trusted issuers in similar integrations?

#cybersecurity #n8n #vulnerability #IAM