CVE-2026-56350
n8n - SSO Enforcement Bypass via API
- State
- Published
- Severity
- 6.0 Medium
- Published
- Jun 30, 2026
- Updated
- Jul 1, 2026
- Reserved
- Jun 20, 2026
Description
n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.0 Medium | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N | VulnCheck |
Weaknesses
- CWE-285 Improper Authorization
Affected Products
| Product | Versions |
|---|---|
n8nn8n |
|
References
- GitHub Security Advisory (GHSA-vjf3-2gpj-233v)vendor-advisory
- VulnCheck Advisory: n8n - SSO Enforcement Bypass via APIthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.