PT-2025-27010 · N8N · N8N

Tatianahub · Published 2025-06-26 · Updated 2025-09-02 · CVE-2025-49592

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: n8n versions prior to 1.98.0

Description: The issue is an Open Redirect vulnerability in the login flow, affecting authenticated users who can be redirected to untrusted domains after logging in. This is achieved by crafting malicious URLs with a misleading redirect query parameter, potentially leading to phishing attacks, credential or 2FA theft, and reputation risk. The vulnerability affects anyone hosting n8n and exposing the "/signin" endpoint to users.

Recommendations: For versions prior to 1.98.0, upgrade to version 1.98.0 or later, which introduces strict origin validation for redirect URLs, ensuring only same-origin or relative paths are allowed after login.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-49592

GHSA-5VJ6-WJR7-5V9F

Affected Products

N8N

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/49xxx/CVE-2025-49592.json · Exploit
• https://github.com/n8n-io/n8n/pull/16034 · Patch
• https://github.com/n8n-io/n8n/security/advisories/GHSA-5vj6-wjr7-5v9f · Vendor Advisory
• https://github.com/n8n-io/n8n/commit/4865d1e360a0fe7b045e295b5e1a29daad12314e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-49592 · Security Note
• https://osv.dev/vulnerability/GHSA-5vj6-wjr7-5v9f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49592 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n%401.98.0 · Note
• https://t.me/cvetracker/27166 · Telegram Post
• https://t.me/cveNotify/134109 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1938392454484341026 · Twitter Post
• https://twitter.com/CVEnew/status/1938324000830005254 · Twitter Post
• https://t.me/cvenotify/126799 · Telegram Post