A vulnerability in n8n's dynamic-node-parameters endpoints allowed authenticated users with access to shared workflows to bypass credential authorization. By supplying a foreign credential ID, an attacker could cause the backend to use another user's API key to authenticate against attacker-controlled infrastructure, effectively exfiltrating reusable API keys. This affects any node resolving credentials dynamically through these endpoints. The issue is fixed in n8n version 2.18.0 and later.