Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck
CVE-2026-56350n8n - SSO Enforcement Bypass via API
Medium 6.3
In plain English
A medium-severity security flaw in n8n from n8n. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.4%top 67.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | n8n | 2.8.0 | GHSA-vjf3-2gpj-233v |
Affected products (as reported)
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
References
- GitHub Security Advisory (GHSA-vjf3-2gpj-233v) vendor-advisory
- VulnCheck Advisory: n8n - SSO Enforcement Bypass via API third-party-advisory