The vulnerability in n8n affects instances configured with more than one trusted token-exchange issuer. The authentication mechanism incorrectly resolves external identities by validating only the JWT sub claim, disregarding the issuer claim. This improper authentication (CWE-287) enables an attacker possessing a valid token from one trusted issuer to authenticate as a victim user under a different issuer if the sub claim matches the victim's identifier. The flaw is present in versions prior to 2.27.4 and versions from 2.28.0 up to but excluding 2.28.1. The vendor fixed the issue in versions 2.27.4 and 2.28.1.

An attacker with a valid token from one trusted issuer can impersonate another user from a different trusted issuer by exploiting the improper validation of JWT claims. This can lead to unauthorized access to the victim's account and potentially sensitive workflows or data within the n8n platform. The vulnerability has a CVSS 4.0 score of 7.6 (high severity), indicating a significant risk if exploited.

Upgrade affected n8n instances to version 2.27.4 or 2.28.1 or later, where the authentication logic correctly validates both the sub and iss claims in JWT tokens. Patch status is confirmed by the vendor advisory indicating these versions fix the issue. No other mitigations are specified.