CVE-2026-72772 affects n8n versions prior to 2.31.5 and 2.32.1. The vulnerability arises from improper validation in the Token Exchange Embed Login feature, where the system accepts a validly-signed token and matches it to a local account by email claim without verifying the email claim's verification status or ensuring the trusted key's role permissions cover the account. Consequently, an attacker who can obtain a token accepted by a configured trusted key (e.g., from a trusted issuer that emits unverified email addresses) can authenticate as any existing user and gain full account control. This vulnerability requires that the embed login feature is enabled and at least one trusted key source is configured.

An attacker able to obtain a token accepted by a trusted key can bypass normal authentication checks and assume the identity of any user in the system, resulting in full account takeover. This compromises the confidentiality and integrity of user accounts and potentially the entire system. The vulnerability has a high severity score of 8.9 (CVSS 4.0) indicating a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disable the Token Exchange Embed Login feature or remove all trusted key sources to prevent exploitation. Monitor vendor communications for updates and apply patches promptly once released.