In short: n8n validated incoming JWTs only against the sub claim and ignored the iss claim, allowing tokens from different issuers to be mixed.
n8n has patched a vulnerability in JWT validation that allowed attackers to sign in as foreign users using a token from a different identity issuer. The issue affected Enterprise instances that trusted multiple external token issuers.
The vulnerability in detail: On n8n Enterprise instances trusting multiple external token issuers, an incoming JWT was validated only against the sub claim (Subject). The iss claim (Issuer) was disregarded. A valid token from Issuer A with a sub value mapped to a user under Issuer B thus resulted in login as that user — without requiring a password.
Security implications for CISOs: This misconfiguration enabled token mix-up attacks and could lead to unauthorized access to third-party user accounts. This is particularly critical in environments where multiple identity providers work together in federations or hybrid scenarios. Attackers with access to any token issuer could have taken over accounts from other organizations or trust domains.
Verification and remediation: CISOs should immediately update n8n Enterprise instances using multiple external issuers to patched versions and review deployments. JWT validation must always consider both the iss and sub claims to prevent cross-issuer account switching.
Source: thehackernews.com · Published 16 July 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.