Back to overview

CVE-2026-56359

MEDIUM
5.4
CVSS 3.1
Description
n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

Metadata

CVE ID
CVE-2026-56359
State
PUBLISHED
Assigner
VulnCheck
Reserved
2026-06-20 21:16 UTC
Published
2026-07-08 13:49 UTC
Last updated
2026-07-08 13:49 UTC
Primary CWE
CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product
n8n / n8n
Sources
cve.org  ·  NVD

Severity & Metrics

5.4 MEDIUM CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products (2)
VendorProductPlatformVersions
n8n n8n — 0 < 2.8.0, 2.8.0
n8n n8n — 0 < 2.6.4, 2.6.4
Weakness (CWE)
CWESourceDescription
CWE-79 cna Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS scores (2)
ScoreSeverityVersionSourceVector
5.4 MEDIUM 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
4.8 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References (2)
Back to overview