CVE-2025-49592: 
JavaScript vulnerability analysis and mitigation

CVE-2025-49592 is an Open Redirect vulnerability (CWE-601) in the login flow of n8n, a workflow automation platform. Versions prior to 1.98.0 (≤ 1.97.0) are affected, allowing authenticated users to be redirected to attacker-controlled domains after logging in via a crafted redirect query parameter on the /signin endpoint. The vulnerability was published on June 26, 2025, and patched in version 1.98.0 released June 11, 2025. It carries a CVSS v3.1 base score of 4.6 (Moderate) (Github Advisory, n8n Security Advisory).

The root cause is insufficient validation of the redirect query parameter in SigninView.vue (CWE-601). The original code used a simple string prefix check (redirect.startsWith('/') || redirect.startsWith(window.location.origin)), which could be bypassed by crafting a URL where the legitimate origin domain appears as a subdomain of an attacker-controlled domain — for example, https://n8n.local.evil.com would pass the check against origin https://n8n.local (n8n PR #16034). The fix replaces this with strict origin comparison using the URL constructor (url.origin === window.location.origin), ensuring only same-origin absolute URLs or relative paths are permitted (Patch Commit). Exploitation requires the attacker to have at least low-level privileges (an authenticated session) and requires user interaction — specifically, a victim clicking a crafted sign-in link.

Successful exploitation enables phishing attacks by redirecting authenticated users to visually similar lookalike domains (e.g., n8n.local.evil.com) that impersonate the n8n UI, potentially leading to credential or 2FA token theft if users are deceived into re-entering sensitive information. There is no direct availability impact, but confidentiality and integrity are both rated low due to the risk of credential exposure and unauthorized actions taken on attacker-controlled sites. Organizations hosting n8n with the /signin endpoint exposed to users face reputational risk from the visual similarity between attacker-controlled domains and their trusted n8n instance (Github Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the advisory date (Github Advisory). No threat actor attribution is available. The EPSS score is approximately 0.179% (39th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify a publicly accessible n8n instance running a version prior to 1.98.0 with the /signin endpoint exposed to users.
2. Craft malicious URL: Construct a sign-in URL with a redirect query parameter pointing to an attacker-controlled domain that includes the legitimate n8n origin as a subdomain prefix, e.g., https://n8n.local/signin?redirect=https%3A%2F%2Fn8n.local.evil.com.
3. Deliver to victim: Send the crafted URL to a target user via phishing email, chat message, or other social engineering channel, making it appear to be a legitimate n8n login link.
4. Victim authenticates: The victim clicks the link, navigates to the real n8n /signin page, and logs in with valid credentials.
5. Redirect to attacker domain: After successful authentication, the vulnerable redirect logic forwards the user's browser to https://n8n.local.evil.com — an attacker-controlled site mimicking the n8n UI.
6. Credential/2FA harvesting: The attacker's lookalike site prompts the victim to re-enter credentials or a 2FA code, which are captured by the attacker (n8n PR #16034, Github Advisory).

• Network: HTTP requests to /signin containing a redirect query parameter with an external domain that includes the n8n instance hostname as a subdomain (e.g., redirect=https://n8n.yourdomain.evil.com); outbound browser redirects to unexpected external domains immediately following successful login.
• Logs: Web server or application access logs showing GET/POST requests to /signin?redirect=https://... where the redirect target domain does not exactly match the n8n instance origin; repeated sign-in attempts from the same IP with varying redirect parameters.
• User Reports: Users reporting being sent to an unfamiliar page after logging in, or receiving unexpected prompts to re-enter credentials or 2FA codes after authentication.

Upgrade n8n to version 1.98.0 or later, which introduces strict origin validation for redirect URLs using the URL constructor to ensure only same-origin absolute URLs or relative paths are permitted after login (n8n Release 1.98.0, Github Advisory). No official configuration-based workaround is provided; the recommended action is to upgrade immediately. As an interim measure, administrators can restrict access to the /signin endpoint to trusted networks or implement a web application firewall rule to block redirect parameters containing external domains.

The vulnerability was reported by researcher tatianahub and published by n8n maintainer csuermann on June 26, 2025 (Github Advisory). The fix was noted positively by reviewers for including unit tests rather than relying solely on end-to-end tests (n8n PR #16034). Social media activity was limited, with a brief mention on Mastodon by RedPacketSecurity shortly after disclosure.