PT-2026-56436 · N8N · N8N

Yohannslm · Published 2026-07-08 · Updated 2026-07-08 · CVE-2026-56359

NVD

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow where authenticated users can inject malicious JavaScript URLs into OAuth2 credential Authorization URL fields. Attackers can craft malicious credentials and trick victims into clicking the OAuth authorization button, executing arbitrary scripts in their browser session with the victim's privileges.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56359

Affected Products

N8N

References · 3

• https://github.com/n8n-io/n8n/security/advisories/GHSA-364x-8g5j-x2pr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56359 · Security Note
• https://vulncheck.com/advisories/n8n-cross-site-scripting-in-credential-management-oauth2-authorization-url · Note