CyberRota Analysis
AI-GeneratedVersions of n8n prior to 2.39.6 and between 2.40.0 and 2.40.1 are susceptible to a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. This flaw allows attackers with resolver registration capabilities to intercept session tokens from collaborators by redirecting them to a malicious endpoint, potentially leading to unauthorized access to sensitive credentials. Organizations using affected n8n versions should prioritize patching to mitigate the risk of credential theft and unauthorized actions within their workflows.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and revoke endpoints. Attackers with resolver registration capability can capture collaborators' session tokens by setting a fallback resolver to an attacker-controlled endpoint during the account connection flow, enabling unauthorized credential access.