CVE-2026-86073: CWE-863: Incorrect Authorization in n8n-io n8n

In n8n versions before 2.37.7 and between 2.38.0 and before 2.38.1, the OAuth token endpoint incorrectly handled refresh tokens by not binding them to the originally consented resource. While the initial access token was correctly bound, the refresh token validation only checked if the requested resource was registered, not if it matched the original grant. This allowed an OAuth client with approval for one workflow to substitute a different workflow URL in the resource parameter during token refresh and obtain a valid token for an unapproved workflow accessible to the consenting user. The vulnerability is classified as CWE-863 (Incorrect Authorization) and has a CVSS 4.0 score of 5.9 (medium severity). The issue is resolved in n8n versions 2.37.7 and 2.38.1.

An attacker with an OAuth client approved for one workflow could exploit this vulnerability to obtain valid tokens for other workflows that the user has access to but did not explicitly approve for that client. This could lead to unauthorized access to workflows, potentially exposing sensitive automation processes or data. The vulnerability requires user interaction (UI:A) and has a medium impact score.

Upgrade n8n to version 2.37.7 or later, or to version 2.38.1 or later, where this authorization issue has been fixed. No other mitigations are indicated by the vendor advisory.