n8n Login Flow has Open Redirect Vulnerability

published 2025-06-26 16 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-19233 , GHSA-5vj6-wjr7-5v9f

cvss: 4.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits: 0; none known

n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to untrusted, attacker-controlled domains after logging in, by crafting malicious URLs with a misleading redirect query parameter. This may lead to phishing attacks by impersonating the n8n UI on lookalike domains (e.g., n8n.local.evil.com), credential or 2FA theft if users are tricked into re-entering sensitive information, and/or reputation risk due to the visual similarity between attacker-controlled domains and trusted ones. The vulnerability affects anyone hosting n8n and exposing the `/signin` endpoint to users. The issue has been patched in version 1.98.0. All users should upgrade to this version or later. The fix introduces strict origin validation for redirect URLs, ensuring only same-origin or relative paths are allowed after login.

Patch / fix

fixed in 2 links 3

npm n8n 1.98.0
n8n n8n 1.98.0

github.com/n8n-io/n8n@4865d1e commit
github.com/n8n-io/n8n#16034 pull request
github.com/n8n-io/n8n/releases/tag/n8n%401.98.0 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 16 mo ago (2025-06-26)

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
GitHub	3.1	4.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
NVD	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
npm	n8n	<1.98.0	1.98.0

Affected products

n8n-io n8n

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

github.com /n8n-io/n8n/pull/16034
web, patch
github.com /n8n-io/n8n/commit/4865d1e360a0fe7b045e295b5e1a29daad12314e
web, patch
github.com /n8n-io/n8n/security/advisories/GHSA-5vj6-wjr7-5v9f
web, vendor-advisory
github.com /n8n-io/n8n/releases/tag/n8n%401.98.0
web, release-notes
nvd.nist.gov /vuln/detail/CVE-2025-49592
advisory
github.com /n8n-io/n8n
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary