n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK
Medium4.7CVE-2026-33720 · Published Mar 25, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 2.8.0 | 2.8.0 |
Details and references
## Impact When the `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK` environment variable is set to `true`, the OAuth callback handler skips ownership verification of the OAuth state parameter. This allows an attacker to trick a victim into completing an OAuth flow against a credential object the attacker controls, causing the victim's OAuth tokens to be stored in the attacker's credential. The attacker can then use those tokens to execute workflows in their name. - This issue only affects instances where `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true` is explicitly configured (non-default). ## Patches The issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Avoid enabling `N8N_SKIP_AUTH_ON_OAUTH_CALLBACK=true` unless strictly required. - Restrict access to the n8n instance to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2026-33720
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 25 | n8n has In-Process Memory Disclosure in its Task Runner CVE-2026-27496High6.5fixed in 1.123.22, 2.9.3, 2.10.1 | High6.5 | 1.123.22, 2.9.3, 2.10.1 |
| Mar 25 | n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660Critical9.9fixed in 1.123.27, 2.13.3, 2.14.1 | Critical9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 25 | n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition CVE-2026-33663High9.9fixed in 1.123.27, 2.13.3, 2.14.1 | High9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 25 | n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover CVE-2026-33665High8.2fixed in 1.121.0, 2.4.0 | High8.2 | 1.121.0, 2.4.0 |
| Mar 25 | n8n Has External Secrets Authorization Bypass in Credential Saving CVE-2026-33722High6.3fixed in 1.123.23, 2.6.4 | High6.3 | 1.123.23, 2.6.4 |
| Mar 25 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CVE-2026-33724Medium5.4fixed in 2.5.0 | Medium5.4 | 2.5.0 |