A flaw in n8n's Enterprise token exchange feature (CVE-2026-59208) allowed attackers to log in as another user by presenting a valid JWT from one trusted issuer that shared a matching `sub` claim with an account registered under a different issuer, because n8n matched users on `sub` alone rather than the correct `iss` + `sub` pairing. The vulnerability only affects Enterprise instances with token exchange enabled and at least two external issuers configured. n8n patched the issue on June 24 in versions 2.27.4 and 2.28.1, though the fix was not mentioned in either release's changelog.
