https://curasec.metacog.co.kr/tags/jwt/Recent content in Jwt on CuraSecHugoen-usFri, 17 Jul 2026 12:06:10 +0000https://curasec.metacog.co.kr/insights/2026-07-17-n8n-token-exchange-flaw-could-let-attackers-log-in-as-users/Fri, 17 Jul 2026 12:06:10 +0000https://curasec.metacog.co.kr/insights/2026-07-17-n8n-token-exchange-flaw-could-let-attackers-log-in-as-users/<ul> <li><strong>Engineer — Plan:</strong> Any n8n Enterprise deployment trusting multiple external JWT issuers is exposed to cross-tenant account takeover via <code>iss</code> claim bypass; patch n8n to the fixed version and audit multi-issuer OIDC/JWT configurations now.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>