Critical Flaw in n8n Automation Platform Allows Attackers to Impersonate Any User Account

A Major Security Slip-Up at n8n

A serious vulnerability has been discovered in n8n, a popular platform that helps businesses automate their workflow processes. The problem centers on how the system verifies that users are who they claim to be when logging in. Researchers found that the platform was not properly checking all the necessary information before granting access, potentially allowing unauthorized people to gain control of legitimate user accounts.

The flaw affects enterprise versions of n8n that are set up to accept login credentials from multiple different identity providers — think of this like a building that accepts keycards from several different security companies. The system was only checking one piece of information (called the "sub" claim) while ignoring another crucial identifier (the "iss" claim) that says which company actually issued the credential. This is like a security guard checking only your name on an ID but not noticing which agency issued it.

How the Attack Works

An attacker could exploit this by obtaining a valid digital certificate from one identity provider and then using it to trick n8n into thinking they are a completely different user from another provider. Because the platform wasn't properly verifying which provider issued the certificate, it would simply match the user's name and grant access — even though the certificate came from the wrong source.

Imagine you have two different driver's licenses with the same name but from different states. A careless bouncer might look only at the name and let someone in, without checking whether the license is actually from a valid state. That's essentially what was happening here.

What This Means

Any organization running an enterprise version of n8n with multiple identity providers has been at risk. An attacker with access to one valid credential could potentially pretend to be any user in the system and steal sensitive business data or run unauthorized commands. For companies using n8n to manage critical business processes, this could have been devastating.

Why You Should Care

If your company uses n8n for automation, this directly affects you. Workflow automation platforms often connect to your most important business systems — email, databases, financial records, and customer information. If an attacker gains access to these systems through n8n, they could cause serious damage. This vulnerability also highlights a broader concern: many organizations trust these platforms with critical data without fully understanding their security practices.

What You Can Do

• Check your systems: If you use n8n, contact your IT team immediately to determine if you're running an affected version
• Update immediately: Apply any security patches released by n8n as soon as they become available
• Review access logs: Check who has recently logged into your n8n accounts to spot any suspicious activity
• Change passwords: Reset credentials for any accounts that could have been compromised
• Monitor activity: Watch for unusual automation workflows or data exports that weren't authorized

This incident serves as a reminder that even tools built to improve efficiency can become security risks if not carefully designed and maintained.