---
id: CVE-2026-56359
title: n8n - Cross-Site Scripting in Credential Management OAuth2 Authorization URL
summary: >-
  n8n before 2.8.0 contains a cross-site scripting vulnerability in the
  credential management flow where authenticated users can inject malicious
  JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can
  craft maliciou…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: n8n
product: n8n
affected:
  - n8n >= 2.7.0 < 2.8.0
  - n8n < 2.6.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-09T13:35:54.521387Z'
published: '2026-07-08'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T21:15:48.392Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-56359'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr'
    label: GitHub Security Advisory (GHSA-364x-8g5j-x2pr)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-cross-site-scripting-in-credential-management-oauth2-authorization-url
    label: >-
      VulnCheck Advisory: n8n - Cross-Site Scripting in Credential Management
      OAuth2 Authorization URL
tags:
  - cve.org
epss: 0.00243
epssPercentile: 0.15496
ingestedAt: '2026-11-03T08:39:35.557Z'
---

## Overview

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

## Affected

- `n8n >= 2.7.0 < 2.8.0`
- `n8n < 2.6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.