In n8n instances with embed login enabled and at least one trusted key configured, the system does not verify that the email claim in a validly signed incoming token is verified or that the token's permitted role ceiling covers the matched local account. Consequently, an attacker who obtains a token accepted by a trusted key that emits unverified email addresses can impersonate any existing user, gaining full control over that account. This vulnerability affects versions prior to 2.31.5 and versions from 2.32.0 up to but not including 2.32.1. The issue has been fixed in version 2.32.1.

An attacker able to obtain a token accepted by a trusted key that does not verify email claims can authenticate as any user in the affected n8n instance, resulting in full account takeover. This compromises user accounts and potentially the entire system depending on the privileges of the impersonated account.

A fix is available in n8n version 2.32.1; users should upgrade to this version or later to remediate the vulnerability. If immediate upgrade is not possible, administrators should disable the embed login feature by setting N8N_TOKEN_EXCHANGE_ENABLED=false. If disabling embed login is not feasible, restrict network access to trusted parties only, audit all configured trusted keys and their allowedRoles assignments, and review auth_identity records for unexpected token-exchange entries linked to high-privilege accounts. These workarounds are temporary and do not fully mitigate the risk.