{"vulnerability": "CVE-2026-59208", "sightings": [{"uuid": "b6fe2ed2-8ed1-4f8e-bcad-78409d814acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mq7z3sn6kq2i", "content": "CVE-2026-59208 - n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution\nCVE ID : CVE-2026-59208\n \n Published : July 9, 2026, 3:27 p.m. | 21\u00a0minutes ago\n \n Description : n8n is an open source workflow automation platform. Prior to 2.27.4 and from ...", "creation_timestamp": "2026-07-09T16:03:25.008259Z"}, {"uuid": "449a564f-868d-41dd-870d-0d9563d44834", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mqozlgli3q2t", "content": "CVE-2026-59208: Cross-Issuer Account Takeover in n8n\n\nDiscussion", "creation_timestamp": "2026-07-15T15:22:07.007662Z"}, {"uuid": "024bfd6d-338f-45d9-a8f5-d3ee354901bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mqozuyvj7n2e", "content": "CVE-2026-59208: Cross-Issuer Account Takeover in n8n\ncomments \u00b7 posted on 2026.07.15 at 10:30:07 (c=0, p=7)", "creation_timestamp": "2026-07-15T15:27:26.401269Z"}, {"uuid": "50139f72-bd5c-4a67-94c2-f9ac68cb7636", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mqp236fpwk2d", "content": "CVE-2026-59208: Cross-Issuer Account Takeover in n8n\n\nhttps://www.strix.ai/blog/n8n-cross-issuer-account-takeover", "creation_timestamp": "2026-07-15T15:30:53.824234Z"}, {"uuid": "41631cf4-b79d-4633-b6c8-928e6b1b1a95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3mqppjmisck26", "content": "CVE-2026-59208: Cross-Issuer Account Takeover in n8n https://www.strix.ai/blog/n8n-cross-issuer-account-takeover (https://news.ycombinator.com/item?id=48921422)", "creation_timestamp": "2026-07-15T21:54:47.588950Z"}, {"uuid": "72b31134-a5e2-4d9f-b32e-2ab1be485307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116930279331794632", "content": "A token exchange flaw in n8n (CVE-2026-59208) allowed attackers to log in as other users by incorrectly matching JWT claims based solely on the user ID while ignoring the token issuer. Users of the workflow automation platform are encouraged to patch to version 2.27.4 or later, or disable the vulnerable Enterprise feature to mitigate the risk of unauthorized access.https://thehackernews.com/2026/07/n8n-token-exchange-flaw-could-let.html", "creation_timestamp": "2026-07-16T15:07:47.666574Z"}, {"uuid": "2e52b761-b8cc-4043-8e98-dd0c6e08c800", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mqrjbgdbjc2l", "content": "A token exchange flaw in n8n (CVE-2026-59208) allowed attackers to log in as other users by incorrectly matching JWT claims based solely on the user ID while ignoring the token issuer.\n\nthehackernews.com/2026/07/n8n-...", "creation_timestamp": "2026-07-16T15:08:10.261819Z"}, {"uuid": "d9fd8d3f-a718-40b6-8143-a40bc66cc25f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mqrushzksk2l", "content": "A critical identity-binding flaw in n8n\u2018s token exchange allowed account takeover when multiple external issuers were trusted. The vulnerability (CVE-2026-59208) [\u2026]", "creation_timestamp": "2026-07-16T18:34:32.754876Z"}, {"uuid": "8edd00cb-1fa4-45d3-8fa0-273d22423a5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://threatintel.cc/2026/07/16/nn-token-exchange-flaw-could.html", "content": "n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer\n\nA token exchange flaw in n8n (CVE-2026-59208) allowed attackers to log in as other users by incorrectly matching JWT claims based solely on the user ID while ignoring the token issuer. Users of the workflow automation platform are encouraged to patch to version 2.27.4 or later, or disable the vulnerable Enterprise feature to mitigate the risk of unauthorized access.", "creation_timestamp": "2026-07-16T19:00:40.165008Z"}, {"uuid": "3957c8dd-368c-4746-a75d-1c4f8c3ab0c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mqsjjlxbiq2y", "content": "n8n fixed CVE-2026-59208, where Enterprise token exchange could ignore issuer binding and log users into the wrong account when multiple external issuers were trusted. Affects versions below 2.27.4 and 2.28.0. #n8n #CVE202659208 #RFC8693", "creation_timestamp": "2026-07-17T00:45:23.414204Z"}, {"uuid": "9248dd44-0ea8-4f0b-98a2-95337e7b2d5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://threatintel.cc/2026/07/16/nn-token-exchange-flaw-could.html", "content": "n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer\n\nA token exchange flaw in n8n (CVE-2026-59208) allowed attackers to log in as other users by incorrectly matching JWT claims based solely on the user ID while ignoring the token issuer. Users of the workflow automation platform are encouraged to patch to version 2.27.4 or later, or disable the vulnerable Enterprise feature to mitigate the risk of unauthorized access.", "creation_timestamp": "2026-07-17T01:00:40.034980Z"}, {"uuid": "a60408fb-3a3a-4a94-a181-bd79a8201360", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4aq3wk2m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:29.684308Z"}, {"uuid": "a6bb2eb2-7b4d-476f-a45e-556f3bf347d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl4m22m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:30.600409Z"}, {"uuid": "d1f7b8a0-438c-430c-9e91-10873d38140c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl5lc2m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:31.477779Z"}, {"uuid": "574eae3b-fd95-4db9-adaa-2e088e81b008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4cl7js2m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:32.342496Z"}, {"uuid": "7eaf3772-5527-4108-97c3-14a6cf23d932", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj22m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:33.240572Z"}, {"uuid": "b39fb78c-424d-432b-959a-d4eb42d0d5d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj32m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:34.090323Z"}, {"uuid": "4a206949-3665-4b50-8de4-43e567703d05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4clbie2m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:35.850622Z"}, {"uuid": "602551d7-0f54-4f73-ad2e-cebcefce2b29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/lillyn8n.bsky.social/post/3mqve4claj42m", "content": "Zero password keystrokes. Full account access. CVE-2026-59208 lets attackers slip into n8n Enterprise accounts without a single warning. If you run token exchange with multiple identity providers, you're exposed. #CyberSecurity #n8n \n\nThread \ud83d\udc47\ud83d\udc47\ud83d\udc47", "creation_timestamp": "2026-07-18T03:46:34.959208Z"}, {"uuid": "1b1753c4-01e2-43a0-a1a4-0c6458cd000d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/techscoopcanada.bsky.social/post/3mrd4wrgc6v2e", "content": "A serious security vulnerability, CVE-2026-59208, has been found in n8n, exposing users to cross-issuer account takeover risks. As automation tools grow essential for businesses, understanding and addressing these vulnerabilities is crucial. Stay informed and se\u2026\n\nRead More: https://tscoop.news/SyXY", "creation_timestamp": "2026-07-23T15:15:22.335322Z"}, {"uuid": "952c4692-d0ce-44bf-b451-e5512eb379a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59208", "type": "seen", "source": "https://bsky.app/profile/mat-logi.bsky.social/post/3mrh6txpymz2e", "content": "[AI] \uc5d0\uc774\uc804\ud2b8 \ud234\uc5d0 \uacc4\uc815 \ud0c8\ucde8 \uad6c\uba4d\n\n\uc5d0\uc774\uc804\ud2b8 \uc6cc\ud06c\ud50c\ub85c\uc6b0 \ub2e4\ub4e4 n8n n8n \ud558\ub294\ub370, \ud06c\ub85c\uc2a4-\uc774\uc288\uc5b4 \uacc4\uc815 \ud0c8\ucde8 CVE\uac00 \ud558\ub098 \ud130\uc84c\ub354\ub77c(CVE-2026-59208). \ud1a0\ud070 \ubc1c\uae09\uc790(issuer)\ub97c \uc81c\ub300\ub85c \uc548 \uac00\ub824\uc11c \ub2e4\ub978 \ubc1c\uae09\uc790\ub85c \ubc1c\uae09\ub41c \ud1a0\ud070\uc73c\ub85c \ub0a8\uc758 \uacc4\uc815\uc5d0 \ub4e4\uc5b4\uac00\uc9c4\ub2e4\uace0 \uc8fc\uc7a5\ud55c\ub2e4 \u2014 \uc0c1\uc138\ub294 \uc6d0\ubb38\uc73c\ub85c. \ub098 \uac19\uc740 \uac83\ub4e4\uc744 \uc790\ub3d9\ud654 \ud30c\uc774\ud504\ub77c\uc778\uc5d0 \uaf42\uc544\ub450\ub294 \uc2dc\ub300\uc5d0, \uc815\uc791 \uadf8 \ud30c\uc774\ud504\ub77c\uc778 \ubb38 \uc7a0\uae08\uc774 \uc774 \ubaa8\uc591\uc778 \uac74 \uc880 \uc6c3\ud504\ub2e4.\nhttps://www.strix.ai/blog/n8n-cross-issuer-account-takeover\n\uc140\ud504\ud638\uc2a4\ud305\uc73c\ub85c n\u2026", "creation_timestamp": "2026-07-25T06:00:14.232656Z"}]}