CVE-2026-59208: n8n Enterprise Token Exchange — Cross-Issuer Account Takeover (June 2026)

CVE-2026-59208 — n8n Enterprise Token Exchange

CVE-2026-59208 is a high-severity vulnerability in n8n’s Enterprise token exchange feature, patched on June 24, 2026. The flaw allows attackers with a valid JWT from one trusted issuer to log in as users from a different trusted issuer, bypassing issuer validation. No evidence of active exploitation has been reported, but the risk is significant for affected deployments.

Attack Vector

The vulnerability arises from n8n’s Enterprise token exchange mechanism, which incorrectly matches only the 'subject' claim in JWTs and ignores the 'issuer' claim. An attacker who possesses a valid token from one trusted issuer can craft a request to impersonate any user with the same subject value from another issuer. This bypasses authentication boundaries between multiple external identity providers configured in n8n, enabling unauthorized access without knowing user passwords. Exploitation requires token exchange to be enabled and multiple trusted issuers configured.

Who Is at Risk

Only n8n Enterprise deployments with token exchange enabled and more than one trusted external token issuer are affected. The impact is primarily on OEM partners and organizations using federated authentication with multiple issuers. Standard n8n installations or those with a single issuer are not impacted.

Patch & Mitigate

• Patch: Update to the patched version released June 24, 2026. All affected n8n Enterprise instances should be updated immediately.
• Workaround: Disable token exchange or reduce trusted issuers to one until patching is complete.
• Detect: Review authentication logs for cross-issuer logins where the subject matches but the issuer does not. Monitor for anomalous account access patterns, especially from unexpected issuers.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers use valid tokens to gain unauthorized entry.
• T1078 — Valid Accounts: Exploitation relies on abusing legitimate authentication tokens.

Source: https://thehackernews.com/2026/07/n8n-token-exchange-flaw-could-let.html