importantSYS.SOURCE: The Hacker News• 2026-07-16T19:03:25+05:30

n8n Token Exchange Vulnerability Allows Cross-Issuer Identity Spoofing

#jwt #enterprise #security #vulnerability #authentication

A vulnerability in n8n's token exchange feature allows attackers to impersonate users from different JWT issuers by exploiting improper validation of the 'iss' claim. The flaw, tracked as CVE-2026-59208, affects Enterprise instances configured with multiple trusted issuers and was patched in version 2.27.4.

n8n, the workflow automation platform, handed out the wrong accounts at login. On Enterprise instances configured to trust more than one external token issuer, it matched an incoming JWT to a local user on the sub claim alone and ignored iss.

A valid token from issuer A carrying a sub that belongs to someone under issuer B logged you in as them. Their password never

Read original article

*** END OF TRANSMISSION ***

> DYSON HOT+COOL HF1 REPLACES SPACE HEATER AND CEILING FAN WITH 2-IN-1 SMART APPLIANCE > APPLE'S TRADE SECRETS LAWSUIT AGAINST OPENAI MAY IMPACT IPO TIMELINE > KEY INSIGHTS ON OPTIMIZING AND MANAGING SQLITE DATABASES > NADMESH BOTNET EXPLOITS EXPOSED AI SERVICES TO STEAL CLOUD CREDENTIALS AND KUBERNETES TOKENS > GOLDENEYEDOG SUBGROUP EXPLOITS DIGICERT BREACH TO STEAL CODE-SIGNING CERTIFICATES > HOMOMORPHIC ENCRYPTION FOR CIFAR-10 INFERENCE WITH 200MS LATENCY > GOOGLE'S NOTO 3D EMOJI DEVELOPMENT: INTEGRATING DESIGN, DATA, AND AI FOR MODERN COMMUNICATION > FBI ARRESTS FLORIDA MAN FOR CRYPTO WALLET THEFT VIA MALWARE-INFECTED STEAM GAMES > COMPANIES DEVELOP SAFER SMARTPHONE SOLUTIONS FOR CHILDREN > EXPLORING MODERN CREATOR WORKSPACES THROUGH WEEKLY DESK SETUP TOURS> DYSON HOT+COOL HF1 REPLACES SPACE HEATER AND CEILING FAN WITH 2-IN-1 SMART APPLIANCE > APPLE'S TRADE SECRETS LAWSUIT AGAINST OPENAI MAY IMPACT IPO TIMELINE > KEY INSIGHTS ON OPTIMIZING AND MANAGING SQLITE DATABASES > NADMESH BOTNET EXPLOITS EXPOSED AI SERVICES TO STEAL CLOUD CREDENTIALS AND KUBERNETES TOKENS > GOLDENEYEDOG SUBGROUP EXPLOITS DIGICERT BREACH TO STEAL CODE-SIGNING CERTIFICATES > HOMOMORPHIC ENCRYPTION FOR CIFAR-10 INFERENCE WITH 200MS LATENCY > GOOGLE'S NOTO 3D EMOJI DEVELOPMENT: INTEGRATING DESIGN, DATA, AND AI FOR MODERN COMMUNICATION > FBI ARRESTS FLORIDA MAN FOR CRYPTO WALLET THEFT VIA MALWARE-INFECTED STEAM GAMES > COMPANIES DEVELOP SAFER SMARTPHONE SOLUTIONS FOR CHILDREN > EXPLORING MODERN CREATOR WORKSPACES THROUGH WEEKLY DESK SETUP TOURS