CVE-2026-86084: n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions

n8n exposes public OIDC login and callback endpoints. Before the fix, they ran the whole flow whether or not OIDC was the instance's enabled, active authentication method. An administrator who switched OIDC off in Settings therefore believed the route was closed, but it still created sessions. This is an alternate-path authentication bypass (CWE-288).

Only n8n Enterprise instances where OIDC was configured at least once and then disabled are affected. Instances that never configured OIDC are not.

In practice, someone who can still authenticate at the identity provider, such as a former employee or an account you meant to cut off when you moved to another login method, can sign in to n8n through the old route. The CVSS vector lists low privileges, which fits an account that exists at the IdP or in n8n. The vector rates confidentiality impact as high, because a session gives access to workflows, credentials and execution data, and integrity impact as low.

The patch requires OIDC to be the enabled, active authentication method before either endpoint starts the flow or issues a session.

Affected: n8n Enterprise below 1.123.76, 2.0.0 up to but not including 2.37.7, and 2.38.0 up to but not including 2.38.2, where OIDC was once configured and is now disabled. Check the version:

npm ls n8n

For Docker installs, check the image tag or the version in the n8n UI. Then check your history: if OIDC was ever set up under Settings and turned off, treat the instance as exposed.

Upgrade to 1.123.76, 2.37.7 or 2.38.2, or later:

npm install -g [email protected]

The advisory lists stopgaps that it says do not fully remediate the risk:

• Disable or revoke the matching application or client at the IdP so the OIDC flow cannot complete.
• Limit network access to the n8n instance to trusted users.

Review n8n login and audit logs for sessions created through the OIDC login and callback endpoints after the date OIDC was disabled. Match those sign-ins against users who should no longer have access. At the identity provider, check authentication events for the n8n client application over the same period. The advisory lists no other indicators.

Impact

The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The patch requires OIDC to be the enabled, active authentication method before either endpoint starts the flow or issues a session.

The issue affects n8n Enterprise instances where OIDC was configured at least once and subsequently disabled.

Patches

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Disable or revoke the corresponding application or client at the IdP level to prevent the OIDC flow from completing.
• Restrict network-level access to the n8n instance to trusted users only.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.