Pr0Ph3T3

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.69 n8n versions prior to 2.33.4 n8n versions prior to 2.34.1 **Description** An SSRF (Server-Side Request Forgery) protection bypass exists during the OAuth2 credential authorization-code-to-access-token exchange. While OAuth2 discovery and dynamic-client-registration requests utilize a protected HTTP client, the token exchange process employs a separate client lacking SSRF guards. A user with credential-creation permissions can configure the access-token URL to point to an internal address. By completing the OAuth2 flow, the system sends a fixed-shape token-exchange POST request to the target and reflects the response body back to the attacker. **Recommendations** Update to version 1.123.69 or later. Update to version 2.33.4 or later. Update to version 2.34.1 or later.