{"cve":"CVE-2026-56350","nvd":{"published":"2026-06-30T23:17:30.867","modified":"2026-07-02T19:38:20.633","status":"Analyzed","description":"n8n before 2.8.0 contains an authentication bypass vulnerability allowing authenticated SSO users to disable SSO enforcement through the API. Attackers can create local password credentials to authenticate directly, bypassing organizational SSO policies and identity-provider-enforced multi-factor authentication.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","score":6.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","score":7.7},"cwes":["CWE-285"],"references":["https://github.com/n8n-io/n8n/security/advisories/GHSA-vjf3-2gpj-233v","https://www.vulncheck.com/advisories/n8n-sso-enforcement-bypass-via-api"],"products":["n8n:n8n"],"source":"nvd","synced_at":"2026-10-19T22:42:16.820116992+00:00"},"epss":{"cve":"CVE-2026-56350","score":0.00379,"percentile":0.3192,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vjf3-2gpj-233v","url":"https://osv.dev/vulnerability/GHSA-vjf3-2gpj-233v","summary":"n8n has an SSO Enforcement Bypass in its Self-Service Settings API","modified":"2026-07-08T08:12:27.872103715Z","packages":[{"ecosystem":"npm","name":"n8n","purl":"pkg:npm/n8n","ranges":["<2.8.0"],"fixed":["2.8.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}