CVE-2025-49592

Executive Summary

CVE-2025-49592 is an Open Redirect vulnerability in the n8n workflow automation platform, affecting versions prior to 1.98.0. The flaw resides in the login flow, where an authenticated user can be redirected to an untrusted, attacker-controlled domain after logging in. This is achieved by crafting a malicious URL with a misleading redirect query parameter. The vulnerability enables phishing attacks, credential theft, and reputation damage by allowing attackers to impersonate the n8n UI on lookalike domains. The CVSS score is 4.6 (Medium), and the official patch was released in version 1.98.0, which enforces strict origin validation for redirect URLs.

Supply Chain & Package Security

n8n is distributed as an npm package (n8n). Organizations using npm to manage their n8n installation should verify they are running version 1.98.0 or later. The vulnerability is not a supply chain compromise but a code-level flaw in the application's redirect logic. However, because n8n is often self-hosted and may be exposed to the internet, the attack surface is significant. Ensure that the npm package is updated from a trusted registry and that the integrity of the package is verified via checksums.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – The attacker must be an authenticated user.
• User Interaction (UI): Required – The victim must click a crafted link.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Potential for credential theft.
• Integrity (I): Low – The redirect can lead to a malicious site.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the real-world impact is elevated due to the potential for phishing and credential harvesting, especially in enterprise environments where n8n may be used to manage sensitive workflows.

Deep Dive & Mechanics

The vulnerability exists in the /signin endpoint of n8n. When a user logs in, the application accepts a redirect query parameter to send the user to a specific page after successful authentication. The flaw is that the application does not validate the origin of the redirect URL. An attacker can craft a URL like:

https://legitimate-n8n-instance.com/signin?redirect=https://n8n.local.evil.com

When an authenticated user clicks this link and logs in, they are redirected to https://n8n.local.evil.com, which may be a phishing site designed to look like the legitimate n8n UI. The attacker can then harvest credentials, 2FA tokens, or other sensitive information.

The root cause is the lack of origin validation for the redirect parameter. The fix in version 1.98.0 implements strict validation, allowing only same-origin or relative paths (e.g., /workflows or https://same-origin.com/workflows).

Vulnerable vs. Patched Code

Vulnerable Code (n8n < 1.98.0):

// Example of vulnerable redirect logic
app.get('/signin', (req, res) => {
  const redirectUrl = req.query.redirect || '/';
  // No validation of redirectUrl
  res.redirect(redirectUrl);
});

Patched Code (n8n >= 1.98.0):

// Example of patched redirect logic with origin validation
const allowedOrigins = ['https://legitimate-n8n-instance.com'];

app.get('/signin', (req, res) => {
  let redirectUrl = req.query.redirect || '/';
  try {
    const parsedUrl = new URL(redirectUrl, req.protocol + '://' + req.get('host'));
    if (!allowedOrigins.includes(parsedUrl.origin) && !redirectUrl.startsWith('/')) {
      redirectUrl = '/';
    }
  } catch {
    redirectUrl = '/';
  }
  res.redirect(redirectUrl);
});

The patched code uses a whitelist of allowed origins and ensures that only same-origin or relative paths are accepted.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate the open redirect to a phishing page.

Lab Setup:

1. Deploy a vulnerable n8n instance (version < 1.98.0) on a local server (e.g., http://n8n.local:5678).
2. Set up a phishing page on a lookalike domain (e.g., http://n8n.local.evil.com) that mimics the n8n login UI.
3. Craft the malicious URL:

   http://n8n.local:5678/signin?redirect=http://n8n.local.evil.com
   

4. Send the URL to a victim (simulated in lab) who is already authenticated to the n8n instance.
5. After the victim logs in, they are redirected to the phishing page, where credentials can be harvested.

Exploit Code (Python):

import requests

# Target n8n instance
target = "http://n8n.local:5678"
# Attacker-controlled phishing domain
phishing_url = "http://n8n.local.evil.com"

# Craft malicious redirect URL
malicious_url = f"{target}/signin?redirect={phishing_url}"
print(f"Send this URL to the victim: {malicious_url}")

# Simulate victim clicking the link (requires session)
session = requests.Session()
response = session.get(malicious_url, allow_redirects=False)
print(f"Redirect status: {response.status_code}")
print(f"Location header: {response.headers.get('Location')}")

Blue Team

Detection:

1. Monitor logs for redirect query parameters containing external domains.
2. Alert on any redirect to domains that do not match the organization's approved list.
3. Use the detection rules below to identify exploitation attempts.

Mitigation:

1. Immediately upgrade to n8n version 1.98.0 or later.
2. If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to validate and block external redirects:

   location /signin {
       if ($arg_redirect !~ ^(/|https?://your-allowed-domain\.com)) {
           return 403;
       }
   }
   

3. Educate users about phishing risks and the importance of verifying URLs before clicking.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /signin?redirect=http:// or /signin?redirect=https:// followed by an external domain.
  • URLs containing lookalike domains (e.g., n8n.local.evil.com, n8n-secure.com).
• Log Entries:
  • HTTP requests to /signin with a redirect parameter pointing to an external domain.
  • 302 redirect responses with a Location header pointing to an external domain.
• Network Traffic:
  • Outbound connections from the n8n server to unknown domains immediately after a login event.
• File Hashes (if phishing page is downloaded):
  • SHA256 of any phishing page mimicking n8n UI (example hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855).

Detection Engineering

YARA Rule

rule CVE_2025_49592_Open_Redirect_n8n {
    meta:
        description = "Detects open redirect attempts in n8n login flow"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-49592"
    strings:
        $redirect_param = "redirect="
        $external_domain = /redirect=https?:\/\/[^\/]/
    condition:
        $redirect_param and $external_domain
}

Sigma Rule

title: CVE-2025-49592 - n8n Open Redirect in Login Flow
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to n8n /signin with a redirect parameter pointing to an external domain.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: GET
        cs-uri-stem: /signin
        cs-uri-query|contains: "redirect=http"
    condition: selection
falsepositives:
    - Legitimate redirects to same-origin domains (should be whitelisted)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49592 - n8n Open Redirect Attempt"; flow:to_server; content:"/signin"; http_uri; content:"redirect="; http_uri; pcre:"/redirect=https?:\/\/[^\/]/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade all n8n instances to version 1.98.0 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, implement a reverse proxy (e.g., Nginx, Apache) to validate the redirect parameter and block external domains.
3. Monitoring: Enable logging for all /signin requests and alert on any redirect to external domains.
4. User Training: Educate users to verify the URL before clicking and to never enter credentials on lookalike domains.
5. Network Segmentation: Restrict access to the n8n /signin endpoint to trusted networks or use VPNs.
6. Web Application Firewall (WAF): Deploy WAF rules to block requests with redirect parameters pointing to external domains.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.