Description

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

Related CPE's

Could not find any relations

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx

https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-unauthenticated-workflow-execution-via-dynamic-path-webhook-resolution

Weaknesses

[email protected]

Primary
CWE-288

CVSS impact metrics

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

6.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-14T23:17:26.197Z

1 hour ago

Last modified

2026-10-14T23:17:26.300Z

1 hour ago