# n8n: OAuth consent can connect another person’s account to a member’s workflows

Canonical: https://www.oktsec.com/radar/n8n-oauth-credential-connect-ghsa-426f-xmcv-g8pg
Publisher: Oktsec
Language: en
Published: 2026-11-14T14:21:38Z
Updated: 2026-11-14T14:21:38Z
Record reviewed: 2026-11-14T14:21:38Z
Latest evidence check: 2026-11-14T14:21:38Z
Disclosed: 2026-10-28

An Enterprise credential connection flaw can assign a consenting person’s provider tokens to another n8n member. It requires resolvable OAuth2 credentials and the person completing consent without an active n8n session.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Review this week
- Rationale: The maintainer provides fixes for an Enterprise flow requiring member access and another person’s consent. The reviewed advisory does not report exploitation.
- Evidence: No attacks reported
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: n8n
- Products: n8n Enterprise

## Technical overview

A member can share a provider authorization link and have another person complete consent. The vulnerable callback does not adequately bind that completion to the initiating identity. Workflows can then use the other person’s provider access.

The October 28 advisory has no assigned CVE at this review. It is separate from the existing Radar advisory about obsolete n8n nodes.

## Recommended response

Upgrade the relevant branch to 2.45.5, 2.46.1 or 3.0.1, or a later corrected release. Review credential ownership and unexpected provider access.

Relevant to: Teams using Enterprise dynamic OAuth2 credentials.

## Affected systems and fixes

### n8n Enterprise with resolvable OAuth2 credentials

Affected: Uncorrected releases using the dynamic credential connection flow.

Fixed release / action: 2.45.5 on the 2.45 branch; 2.46.1 on the 2.46 branch; 3.0.1 on the 3.0 branch

Confirm the running version against the vendor advisory, including any distribution backports.

## Response checklist

1. **Confirm applicability** — Check the Enterprise edition, dynamic credential configuration and installed branch.
2. **Apply the branch correction** — Install a corrected release. Temporary vendor measures include N8N_OAUTH_BROWSER_BINDING=true, limiting access to trusted members and disabling unused dynamic credentials; they do not replace the fix.
3. **Check provider grants** — Oktsec recommends investigating unexpected credential ownership and revoking affected provider grants if misuse is found.

## Relevance to AI environments

Check which provider identity each automated workflow actually uses.

## Sources

- [OAuth credential callback: scope, corrections and temporary measures](https://github.com/n8n-io/n8n/security/advisories/GHSA-426f-xmcv-g8pg) — n8n; Vendor notice; checked 2026-11-14T14:21:38Z

## Editorial record

- 2026-11-14T14:21:38Z: Added verified scope, correction and evidence limits from primary sources.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/n8n-oauth-credential-connect-ghsa-426f-xmcv-g8pg) · [Build a response plan](https://www.oktsec.com/radar/n8n-oauth-credential-connect-ghsa-426f-xmcv-g8pg#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=n8n-oauth-credential-connect-ghsa-426f-xmcv-g8pg&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=n8n-oauth-credential-connect-ghsa-426f-xmcv-g8pg&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.