Attack Chain

1. Initial Reconnaissance: Attacker identifies a vulnerable n8n instance with the embed login feature enabled and at least one trusted key source configured.
2. Trusted Issuer Identification: Attacker identifies a configured trusted identity provider that issues tokens which include unverified email claims.
3. Token Acquisition/Forgery: Attacker obtains a validly-signed token from the identified trusted issuer, potentially by exploiting a weakness in the issuer itself or by crafting a token with an unverified email claim matching an existing n8n user.
4. Impersonation Attempt: The attacker presents this specially crafted token to the n8n instance's embed login endpoint, claiming the identity of an existing n8n user via the unverified email claim.
5. Authentication Bypass: Due to the vulnerability, n8n fails to verify the email claim's validity or the trusted key's role ceiling against the target account, and mistakenly authenticates the attacker.
6. Account Takeover: The attacker gains full control over the targeted n8n user's account, including access to workflows, data, and configuration.
7. Impact on Target: Attacker can now execute arbitrary workflows, exfiltrate sensitive data, or disrupt business operations.

Impact

Successful exploitation of this vulnerability leads to full account takeover within the n8n instance. An attacker can authenticate as any existing user, gaining access to all their associated data, workflows, and permissions. This can result in unauthorized data access, modification, or deletion, as well as the execution of malicious automation workflows. The risk is specifically present for n8n instances where the embed login feature is enabled and at least one trusted key source is configured, particularly if those trusted keys are associated with identity providers that emit unverified email addresses.

Recommendation

• Upgrade n8n instances to version 2.32.1 or later immediately to remediate the vulnerability.
• If immediate upgrade is not possible, disable the embed login feature by setting the environment variable N8N_TOKEN_EXCHANGE_ENABLED=false.
• If embed login cannot be disabled, restrict network access to the n8n instance to fully trusted parties only.
• Audit all configured trusted keys and their allowedRoles assignments for any unnecessarily broad permissions.
• Review auth_identity records for unexpected token-exchange entries, especially those linked to high-privilege accounts, as a post-compromise indicator.