highJul 22, 2026

n8n: Account Takeover via Unverified Email Claim in Embed Login Token Exchange

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A flaw in n8n's embed login feature lets an attacker with any token from a configured trusted key authenticate as any existing user by supplying that user's email address in the JWT, even if the…

Packagen8n
Ecosystemnpm
Affected>= 2.32.0, < 2.32.1
Fixed in2.32.1

The problem

When n8n's token exchange embed login is enabled, the service matches an incoming JWT to a local account by its email claim. Before 2.32.1, it did not require email_verified: true, and it did not check whether the trusted key's configured allowedRoles ceiling covered the target account's role.

Anyone who could obtain a validly-signed token from any configured trusted issuer could set email to the address of any existing n8n user, including owners and admins, and log in as them with full account control. No password or MFA was required.

Proof of concept

A working proof-of-concept for this issue in n8n, with the exact payload below.

json
# Step 1: craft a JWT payload with the victim's email and email_verified omitted (or false)
# Sign it with a private key whose public key is already trusted by the n8n instance.

{
  "iss": "https://your-trusted-issuer.example.com",
  "sub": "attacker-user-id",
  "email": "admin@target-company.com",
  "email_verified": false,
  "iat": 1751000000,
  "exp": 1751003600
}

# Step 2: exchange the signed JWT for an n8n session
POST /rest/login HTTP/1.1
Host: n8n.target.internal
Content-Type: application/json

{
  "token": "<signed-JWT-above>",
  "grantType": "urn:ietf:params:oauth:grant-type:token-exchange"
}

The root cause is two missing checks in the token exchange identity-resolution path. First, the code accepted any email claim without requiring email_verified: true, so issuers that emit unverified addresses (common in social-login and federated IdP flows) could supply an arbitrary email.

Second, the service never compared the resolved account's role against the trusted key's allowedRoles ceiling, so even a low-privilege key could be used to claim an owner-level account.

The patch (commit f69dfc6) adds both checks: it now rejects tokens where email_verified is absent or false, and it gates authentication on the matched account's role falling within the key's permitted role set. CWE-346 (Insufficient Verification of Data Authenticity) covers the unverified email claim, and CWE-863 (Incorrect Authorization) covers the missing role-ceiling check.

The fix

Upgrade to n8n 2.32.1 or later. If an immediate upgrade is not possible: set N8N_TOKEN_EXCHANGE_ENABLED=false to disable embed login entirely, or restrict network access to the instance and audit all trusted keys and their allowedRoles assignments. Also review auth_identity records for unexpected token-exchange entries linked to owner or admin accounts.

Reported by bearsyankees (Strix).

References: [1][2][3][4][5]

Related research