Loading story…
Nhost disclosed an improper authentication vulnerability, tracked as CVE-2026-41574 and GHSA-6G38-8J4P-J3PR, that allowed attackers to take over user accounts through flawed OAuth account-linking logic. In affected versions prior to 0.49.1, Nhost automatically linked an incoming OAuth identity to an existing local account when the email addresses matched, even if the third-party provider had not actually verified ownership of that email address.
The issue affected several OAuth adapters, including Discord, Bitbucket, AzureAD, and EntraID, where verification data could be mishandled or trusted incorrectly. An attacker could create a third-party identity using a victim’s email address without completing email verification, then sign in through OAuth and have Nhost merge that identity into the victim’s account, resulting in a fully authenticated session as the victim. Nhost patched the vulnerability in version 0.49.1.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Nhost released a fix for the account takeover issue in version 0.49.1. The vulnerability involved several adapters, including Discord, Bitbucket, AzureAD, and EntraID, that could incorrectly treat unverified email addresses as verified during OAuth login.
A severe improper authentication vulnerability affecting Nhost versions prior to 0.49.1 was publicly disclosed. The flaw allowed account takeover when OAuth identities were automatically linked to existing accounts based on matching email addresses even if the provider had not actually verified the email.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvereports.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical server-side request forgery flaw in the **n8n** workflow automation platform, tracked as `CVE-2026-56348`, allowed any authenticated user to bypass the product’s Allowed HTTP Request Domains restriction and coerce the server into sending stored credentials to attacker-controlled hosts. The issue affected all versions before `2.20.0` and stemmed from missing credential permission validation in the `refineResourceIds()` path behind the `POST /rest/dynamic-node-parameters/options` endpoint, enabling exposure of API keys, OAuth tokens, and passwords without confirming `credential:read` access. n8n fixed the vulnerability by adding credential access checks through `CredentialsFinderService` and returning a `ForbiddenError` when validation fails, while no public proof-of-concept had been reported at disclosure. Separately, the Canadian Centre for Cyber Security issued an advisory urging organizations to review n8n’s latest vendor notices and apply updates affecting versions prior to `1.123.64`, `2.29.8`, and `2.30.1`, underscoring continued patching requirements across multiple release branches.
Jul 12, 2026
n8n disclosed **CVE-2026-59208**, an improper authentication flaw in the Enterprise **token exchange** feature that can let a user with a valid JWT from one trusted external issuer be logged into another user’s local account. The bug stems from n8n matching identities only on the JWT `sub` claim while ignoring the `iss` claim, creating a cross-issuer collision risk when multiple trusted issuers are configured and subject values overlap. Successful exploitation could give an attacker the victim’s n8n permissions, including access to workflows, stored credentials, and connected business systems. The issue affects Enterprise deployments using token exchange with at least two trusted external issuers configured, including versions earlier than **2.27.4** on the 2.27 branch and **2.28.0** on the 2.28 branch. n8n fixed the flaw in **2.27.4** and **2.28.1** on June 24, and public reporting said there was no confirmed active exploitation or public proof-of-concept as of July 16. Organizations are advised to upgrade immediately, review trusted issuer settings, validate issuer-to-user binding after patching, and, if patching is delayed, reduce configurations to a single issuer or disable token exchange temporarily.
Jul 17, 2026
Threat actors published **malicious npm packages** masquerading as legitimate *n8n* community nodes, abusing n8n’s extensibility to **steal OAuth tokens and other sensitive credentials** from environments that installed the rogue integrations. Reporting identified at least **eight** fake nodes impersonating popular services (e.g., Google Ads, Stripe, Salesforce), including `n8n-nodes-hfgjf-irtuinvcm-lasdqewriit` and `n8n-nodes-gasdhgfuy-rejerw-ytjsadx`, with authors using pseudonymous handles such as **kakashi-hatake**, **zabuza-momochi**, **dan_even_segler**, **hezi109**, **haggags**, **vietts_code**, and **diendh**. The packages prompted users to authenticate in seemingly legitimate flows and then exfiltrated credentials to attacker-controlled infrastructure; several packages were removed after discovery, while additional related packages from some of the same accounts were still being tracked for potentially similar behavior. Separately, a government advisory warned of **multiple high-severity vulnerabilities in n8n**—including `CVE-2026-21858` (improper input validation that may enable **unauthenticated remote code execution** via webhook request parsing and file handling), alongside `CVE-2026-21877` and `CVE-2025-68613`—and provided mitigation and detection guidance for defenders. This vulnerability advisory is distinct from the npm supply-chain campaign (malicious third-party nodes vs. core product flaws), but both issues increase risk for organizations running n8n, particularly **self-hosted deployments** that may function as centralized stores for OAuth tokens, API keys, and other integration secrets.
Jun 29, 2026