The vulnerability in n8n involves an SSRF protection bypass in the OAuth2 token exchange process. While OAuth2 discovery and dynamic-client-registration requests use an SSRF-protected HTTP client, the token exchange uses a separate client lacking SSRF protections. This allows a user with credential-creation permissions to specify an access-token URL pointing to an internal address, complete the OAuth2 flow, and cause n8n to send a token-exchange POST request to that internal target. The response body from that target is then reflected back to the attacker, limited to the specific response to the token-exchange request.

An attacker with credential-creation permissions can exploit this vulnerability to perform SSRF attacks by making n8n send token-exchange requests to internal network addresses. This could potentially expose internal service responses to the attacker. The CVSS score is low (2.3), indicating limited impact and complexity. There is no indication of privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation is indicated in the provided data. Until a patch is available, restrict credential-creation permissions to trusted users only to reduce risk.