n8n has an SSO Enforcement Bypass in its Self-Service Settings API
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-269 and CWE-284.
Summary
## Impact An authenticated user signed in through Single Sign-On (SSO) could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy, centralized identity management, and any identity-provider-enforced multi-factor authentication. ## Patches The issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Monitor audit logs for users who create local credentials after authenticating via SSO. - Restrict the n8n instance to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | n8n (npm) | before 2.8.0 | 2.8.0 | Patch available | GHSA-vjf3-2gpj-233v |
- n8n (npm) Vendor— Affected before 2.8.0 Fixed in 2.8.0 Patch available GHSA-vjf3-2gpj-233v
Remediation
- Fix · GHSA-vjf3-2gpj-233v n8n (npm) Fixed in 2.8.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-vjf3-2gpj-233v
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences