https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 15 Nov 2026 07:49:28 +0000 https://db.gcve.eu/vuln/cve-2026-126385 <p><strong>Affected:</strong> n8n-io n8n</p> <p>n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim&#39;s tokens are stored under the member&#39;s identity, letting the member&#39;s workflows act as the victim.</p> <p><strong>Affected:</strong> n8n-io n8n</p> <p>n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the dynamic-credential connect flow, which does not verify that the completing browser belongs to the user who started the flow. Members with access to a resolvable OAuth2 credential can send the provider authorization URL to a victim; if the victim consents without an active n8n session, the victim&#39;s tokens are stored under the member&#39;s identity, letting the member&#39;s workflows act as the victim.</p> https://db.gcve.eu/vuln/cve-2026-126385