n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
The process automation platform n8n distributed the incorrect login credentials. It matched an incoming JWT to a local user on the sub claim alone and disregarded iss on enterprise instances set up to trust multiple external token issuers.
A legitimate token issued by the issuer You were logged in as A when you carried a sub that belonged to someone under issuer B. They never entered their password. On June 24, n8n shipped the fix.
CVE-2026-59208 is the tracking number for the vulnerability. It wasn't until July 9 that the CVE record became public. The report is attributed by n8n to the GitHub user bearsyankees, whose profile mentions Strix, an AI penetration testing tool.
According to Strix, the identity-binding problem was discovered by the agent at the token-exchange flow.
...