AI Threat Alert
CVE-2026-72772
AWAITING NVDn8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's...
Full CISO analysis pending enrichment.
How severe is it?
What should I do?
No patch available
Monitor for updates. Consider compensating controls or temporary mitigations.
Which compliance frameworks are affected?
Compliance analysis pending. Sign in for full compliance mapping when available.
Frequently Asked Questions
What is CVE-2026-72772?
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
Is CVE-2026-72772 actively exploited?
No confirmed active exploitation of CVE-2026-72772 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-72772?
No patch is currently available. Monitor vendor advisories for updates.
What is the CVSS score for CVE-2026-72772?
No CVSS score has been assigned yet.
What are the technical details?
Original Advisory
n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the email claim was verified, nor that the trusted key's permitted role ceiling covered that account. As a result, anyone able to obtain a token accepted by a configured trusted key (for example, a trusted issuer emitting unverified email addresses) could authenticate as any existing user and gain full account control. This issue only affects instances where the embed login feature is enabled and at least one trusted key source is configured.
Weaknesses (CWE)
CWE-640 — Weak Password Recovery Mechanism for Forgotten Password: The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
- [Architecture and Design] Make sure that all input supplied by the user to the password recovery mechanism is thoroughly filtered and validated.
- [Architecture and Design] Do not use standard weak security questions and use several security questions.
Source: MITRE CWE corpus.