n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer
n8n's Enterprise token-exchange feature matched incoming JWTs to local accounts on the sub claim alone and ignored iss, so a valid token from one trusted issuer could log in as a user belonging to another; the fix shipped June 24 and the CVE, tracked as...