CVE-2026-103259

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.39.6 n8n versions 2.40.0 through 2.40.0

Description Session token leakage occurs in the Dynamic Credentials 'authorize' and 'revoke' endpoints. Attackers with resolver registration capability can capture session tokens of collaborators by configuring a fallback resolver to point to an attacker-controlled endpoint during the account connection flow, which allows unauthorized access to credentials.

Recommendations Update n8n to version 2.39.6 or later. Update n8n to version 2.40.1 or later.