A token exchange vulnerability in n8n Enterprise lets valid JWTs from one trusted identity provider authenticate as users from another issuer when subject identifiers collide.
Imagine typing no password at all. None. Zero keystrokes. Yet suddenly, you’re inside someone else’s account. Their workflows. Their data. Their entire digital workspace, laid bare before you.
That is not a scene from a hacker movie. That is CVE-2026-59208, a vulnerability lurking inside n8n’s Enterprise deployments right now.
If you run n8n Enterprise with token exchange enabled—and you trust more than one external identity provider—you need to read this carefully. The bug allows a valid, properly signed token from one issuer to log an attacker in as a completely different user from another issuer. No password required. No warning signs. Just silent access.
Here is how a seemingly secure authentication feature turned into an identity mix-up waiting to happen.
When Trust Becomes Blind
n8n built its token exchange feature for software partners. Picture an OEM embedding n8n inside their own product. The partner signs a short-lived JSON Web Token using their private key. n8n verifies this against pre-configured public keys stored in your N8N_TOKEN_EXCHANGE_TRUSTED_KEYS setting. Clean, elegant, built on the RFC 8693 OAuth token exchange standard.
The signature verification worked perfectly. Every check passed. The flaw waited one step later.
When n8n matched a verified token to a local account, it looked only at the “sub” field. That is the subject field in JWTs, the bit that supposedly identifies the user. But here is the thing about RFC 7519: a sub value is only guaranteed to be unique within the issuer that created it. Not globally unique. Not across different companies. Just unique to that single issuer.
n8n never checked the “iss” field. Never verified which issuer the token came from. It simply matched the sub value and opened the door.
The Collision That Opens Doors
Think about two different partner systems. Partner A assigns “user123” to Alice. Partner B assigns “user123” to Bob. These are two different people at two different companies. But n8n sees “user123” and thinks: same person.
A valid, properly signed token from Issuer A could therefore log an attacker in as Bob—recognizing the attacker as the user known to Issuer B. All because both systems happened to use the same subject identifier.
The vulnerability only strikes when your Enterprise instance runs token exchange with two or more external issuers simultaneously. Reduce your trust to a single source, and the collision scenario vanishes. But that is a band-aid, not a cure.
A Preview Feature with Production Consequences
n8n’s official documentation still labels token exchange as a preview feature. Not fully stable. Not production-ready. Yet Enterprise customers—particularly OEM partners—rely on it daily. n8n has stated that no other configurations are affected. Since token exchange remains restricted to Enterprise plans, the pool of exposed deployments stays narrow.
But narrow does not mean empty. If you depend on this feature for embedded workflows, you are in the crosshairs.
The Numbers Don’t Lie (But They Disagree)
How bad is it really? That depends on who you ask.
GitHub, acting as the CVE Numbering Authority, rated CVE-2026-59208 a 7.6 out of 10 on the CVSS 4.0 scale. That lands squarely in high severity territory. The scoring notes that specific attack requirements must be met—namely, the multi-issuer configuration and the token exchange feature being active.
The National Vulnerability Database saw it differently. They scored the same flaw at 6.8 on the older CVSS 3.1 scale, marking it medium severity. At the time of disclosure, NVD had not published a CVSS 4.0 rating of their own. They linked the vulnerability to two weakness categories: CWE-287 for improper authentication and CWE-346 for origin validation errors.
The Cybersecurity and Infrastructure Security Agency assessed the flaw’s Stakeholder-Specific Vulnerability Categorization on July 13, 2026. They recorded no evidence of active exploitation at that time. Security researchers at The Hacker News likewise reported finding no public proof-of-concept code as of July 16, 2026.
So the danger is real, but the attacks have not started—yet.
Déjà Vu: Another Enterprise Access Control Failure
This is not n8n’s first rodeo with Enterprise access control this year.
Roughly two weeks prior to this disclosure, the team patched CVE-2026-54305. That separate flaw allowed any authenticated user to overwrite or revoke another user’s stored OAuth tokens through the platform’s Dynamic Credentials endpoints. Where CVE-2026-54305 stemmed from a missing ownership check, CVE-2026-59208 stems from incomplete identity verification in multi-issuer contexts.
Two different bugs. Two different code paths. One troubling theme.
As n8n’s Enterprise tier adds more integration points with external identity and credential systems, the boundaries around who can act as whom have required repeated scrutiny. Each new connection point is a potential confusion point. Each external trust relationship is a chance to mix up identities.
How an AI Agent Found What Humans Missed
The discovery story adds another layer of intrigue.
n8n credited the find to a GitHub account using the handle bearsyankees. That profile references Strix, a company building an AI-driven penetration testing agent. According to Strix, their automated agent specifically targeted n8n’s token exchange flow during testing. It surfaced the identity-binding weakness that human reviewers had overlooked.
A machine found the gap between verification and validation. Between checking a signature and checking where it came from. The irony is thick: an AI testing a workflow automation platform, finding a bug in how that platform automates trust.
The Fix That Hid in Plain Sight
The fix first appeared in n8n versions 2.27.4 and 2.28.1. It addresses every release below those version numbers, including version 2.28.0 specifically. As of July 16, 2026, n8n’s npm package listed version 2.30.6 under both its latest and stable tags, reflecting the company’s typical release cadence of a new minor version most weeks.
But here is where it gets concerning for security teams.
Neither the 2.27.4 nor the 2.28.1 changelog mentions the security fix. Those changelogs reference a Python import correction, an update to the Google Ads node, an AI workflow validation check, and a change to how nodes are built. Routine stuff. Nothing about authentication bypasses or identity confusion.
The only place the fix is documented is in n8n’s dedicated security advisory. This is exactly why you cannot rely on release notes alone. The vulnerability went unnoticed in public changelogs even after it was patched, highlighting a dangerous gap between routine release notes and security disclosure visibility for administrators.
If you are scanning changelogs for security issues, you missed this one.
Your Immediate Options
Administrators who cannot patch immediately have two interim paths.
First, reduce trusted issuers to a single trusted source. This removes the collision scenario entirely. Two issuers cannot clash if only one exists. But this does not fix the underlying verification logic. It merely avoids the trigger condition.
Second, disable token exchange entirely. Clean, simple, absolute. But for OEM deployments dependent on the feature, this is not viable. If your business model requires embedded n8n access for partners, turning off the feature means turning off your product.
Any instance running with token exchange disabled is not affected by this vulnerability regardless of patch level. The bug simply cannot activate if the feature is not running.
What remains unclear from n8n’s advisory is exactly how an attacker would obtain a token bearing another user’s subject value. The real-world exploitation path sits somewhat uncertain. You need a valid, signed token from a trusted issuer first. Then you need that issuer to have assigned a subject value that matches a different user at a different issuer.
It is a specific chain. But security through obscurity is not security at all.
The Trust Lesson You Cannot Ignore
This vulnerability teaches a brutal lesson about modern authentication architectures.
You can follow every standard correctly—RFC 8693, RFC 7519, OAuth token exchange—and still create a hole big enough to walk through. The signature was valid. The key was trusted. The token was fresh. Yet the identity was wrong.
When you trust external identity providers, you inherit their uniqueness guarantees. Or lack thereof. If you assume a subject identifier means the same thing coming from different sources, you are gambling with your users’ accounts.
The fix exists. The patches are available. The clock is ticking on when attackers will figure out the exploitation chain that security researchers still view as uncertain.
Do not wait for the first breach headlines. Check your N8N_TOKEN_EXCHANGE_TRUSTED_KEYS configuration today. Verify how many issuers you trust. Review whether you actually need token exchange running, or if it is just enabled by default because it sounded useful.
Your users assume their accounts belong only to them. Make sure your authentication logic agrees.