---
id: CVE-2026-86084
title: n8n is an open source workflow automation platform
summary: >-
  n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7,
  and 2.38.2, the public OIDC login and callback endpoints completed
  authentication even when OIDC was not the enabled active authentication
  method. An Enterpri…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-288
vendor: n8n
product: n8n
affected:
  - n8n < 1.123.76
  - 'n8n >= 2.0.0, < 2.37.7'
  - 'n8n >= 2.38.0, < 2.38.2'
patched:
  - n8n 2.38.2
published: '2026-09-08'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T21:10:42.127'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86084'
references:
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76'
    label: security-advisories@github.com
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7'
    label: security-advisories@github.com
  - url: 'https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2'
    label: security-advisories@github.com
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-pf83-w3f9-8m37'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86084'
  - url: 'https://github.com/advisories/GHSA-pf83-w3f9-8m37'
tags:
  - nvd
  - ghsa
  - npm
  - cve.org
aliases:
  - GHSA-pf83-w3f9-8m37
ecosystem: npm
epss: 0.00461
epssPercentile: 0.37429
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-09T13:49:33.721879Z'
scores:
  nvd: 5.5
  cna: 6
ingestedAt: '2026-09-08T22:12:31.039Z'
---

## Overview

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints completed authentication even when OIDC was not the enabled active authentication method. An Enterprise administrator who had configured and later disabled an identity provider still exposed a working route that could issue valid sessions. The affected logic is packages/cli/src/modules/sso-oidc/oidc.service.ee.ts, including generateLoginUrl and the callback flow that lacked assertOidcLoginEnabled. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

## Affected

- `n8n < 1.123.76`
- `n8n >= 2.0.0, < 2.37.7`
- `n8n >= 2.38.0, < 2.38.2`

## Remediation

Upgrade past the affected range:

- `n8n 2.38.2`

## Package advisory (CVE-2026-86084)

Affected packages:

- `n8n < 1.123.76`
- `n8n >= 2.38.0, < 2.38.2`
- `n8n >= 2.0.0, < 2.37.7`

Patched in:

- `n8n 1.123.76`
- `n8n 2.38.2`
- `n8n 2.37.7`

Source: https://github.com/advisories/GHSA-pf83-w3f9-8m37