CVE-2026-103259 is an incorrect authorization vulnerability in n8n affecting versions prior to 2.39.6 and between 2.40.0 and before 2.40.1. The flaw exists in the Dynamic Credentials authorize and revoke endpoints, where an attacker with resolver registration capability can manipulate the fallback resolver during the account connection flow to an attacker-controlled endpoint. This manipulation results in leakage of collaborators' session tokens, enabling unauthorized access to sensitive credentials.

Successful exploitation allows attackers with resolver registration capability to capture session tokens of collaborators, leading to unauthorized access to credentials. This could compromise sensitive data and operations that rely on these credentials. The CVSS 4.0 score of 8.5 indicates a high severity vulnerability with network attack vector, low attack complexity, and partial user interaction required.

A fix is available in n8n versions 2.39.6 and 2.40.1 and later. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patches.