Summary
A session token leakage vulnerability in n8n's Dynamic Credentials authorization and revocation flow can expose collaborators' session tokens to an attacker-controlled resolver.
An attacker with resolver registration capability may use a fallback resolver during account connection to obtain tokens and access credentials without the intended user's authorization.
Affected context
The vulnerability occurs in n8n deployments using Dynamic Credentials account connection flows where users with resolver registration capability can configure fallback resolvers. Risk is present when the authorization or revocation endpoints allow session-related data to reach a resolver endpoint controlled by that user or an external attacker.
Exploit preconditions
- Attack surface: Dynamic Credentials authorize and revoke endpoints
- Required access: Resolver registration capability within the n8n instance
- Trigger point: An account connection flow that uses a configured fallback resolver
- Attacker-controlled component: A resolver endpoint capable of receiving or observing forwarded request data
- Why exploitation is possible: Authorization controls and token-handling boundaries allow collaborator session tokens to be exposed through the resolver flow
Why this happens
The underlying issue is an authorization and trust-boundary failure in the Dynamic Credentials resolver workflow. A resolver that can be registered by an attacker is allowed to participate in an account connection flow without sufficiently restricting access to collaborator session tokens.
This maps to CWE-863: Incorrect Authorization, where an operation or data exposure is not adequately limited to the users or components authorized to receive it. The insecure pattern is treating a configurable fallback resolver as trusted while processing sensitive session information.
Potential impact
- An attacker could capture collaborator session tokens
- Compromised tokens may enable unauthorized account or credential access
- Attackers may impersonate affected users within the application
- Connected external services and stored credentials could be exposed or misused
- Follow-on actions could include data access, modification, or service disruption
General mitigation guidance
Mitigation generally focuses on enforcing strict authorization boundaries around resolver registration and sensitive token handling.
Common defensive patterns include:
- Preventing user-controlled or untrusted resolvers from receiving session tokens
- Ensuring fallback resolvers receive only the minimum data required for their function
- Separating account-connection control data from authentication and session artifacts
- Requiring explicit administrative approval for resolver registration
- Applying least privilege to resolver identities and connected credential access
- Binding tokens to the intended user, flow, and audience where feasible
- Invalidating exposed or replayable session tokens when suspicious routing is detected
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of authorization and resolver-registration paths
- Code review checks for session tokens passed to configurable or third-party endpoints
- Tests that verify unauthorized resolver identities cannot observe authentication artifacts
- Logging and alerting for resolver registration, fallback changes, and unusual token-related requests
- Policy enforcement that blocks unapproved resolver destinations and requires administrative review
Automated application security testing and code review tools may help identify insecure data flows and missing authorization checks.
