6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-vjf3-2gpj-233v

GHSA-vjf3-2gpj-233v: n8n has an SSO Enforcement Bypass in its Self-Service Settings API

Impact

An authenticated user signed in through Single Sign-On (SSO) could disable SSO enforcement for their own account through the n8n API. This allowed the user to create a local password and authenticate directly with email and password, completely bypassing the organization's SSO policy, centralized identity management, and any identity-provider-enforced multi-factor authentication.

Patches

The issue has been fixed in n8n version 2.8.0. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Monitor audit logs for users who create local credentials after authenticating via SSO.
Restrict the n8n instance to fully trusted users only.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-vjf3-2gpj-233v

GHSA-vjf3-2gpj-233v:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 2.8.0	2.8.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an authenticated user to bypass SSO enforcement by modifying their own account settings. The root cause is improper privilege management in the self-service settings update endpoint. The provided patch addresses this by introducing a new, more restrictive Data Transfer Object (DTO), UserSelfSettingsUpdateRequestDto, for the user-facing endpoint (/me/settings).

Previously, the MeController.updateCurrentUserSettings method used the SettingsUpdateRequestDto, which was a general-purpose DTO that included sensitive, admin-only fields like allowSSOManualLogin. By sending a PATCH request to /me/settings with {"allowSSOManualLogin": true}, a user could disable the SSO requirement for their account.

The fix replaces SettingsUpdateRequestDto with UserSelfSettingsUpdateRequestDto in the MeController.updateCurrentUserSettings method. The new DTO explicitly omits allowSSOManualLogin and other sensitive properties, ensuring that users cannot modify these settings themselves. The backend now relies on Zod validation to strip any extraneous fields from the request payload, effectively preventing the SSO bypass. The key vulnerable function is the controller method on the backend that processed this malicious request.

Vulnerable functions

MeController.updateCurrentUserSettings

packages/cli/src/controllers/me.controller.ts

The `updateCurrentUserSettings` method in the `MeController` was vulnerable because it used the `SettingsUpdateRequestDto` for updating user settings via the `/me/settings` endpoint. This DTO included the `allowSSOManualLogin` field, which is intended for administrators only. An authenticated user could send a crafted request to this endpoint to set `allowSSOManualLogin` to `true` for their own account, thereby disabling SSO enforcement and allowing them to log in with a password, bypassing the organization's SSO policy.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.