CVE-2026-126385

The n8n platform (versions before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1) contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow. The system fails to verify that the browser completing the flow belongs to the user who initiated it. An attacker with ac...

EUVD-2026-125180

n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential...

CVE-2026-126385 n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback

n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential...