Description

Detects n8n users who have n8n multi-factor authentication turned off, so their password is the only factor n8n asks for at sign-in. A password that is stolen, reused or guessed is then enough to open the account and reach every workflow and credential the user can use. On an instance that signs in through SAML or OIDC, only the owner is evaluated, since n8n leaves the second factor of the users who sign in through the identity provider to that provider, and the public API does not show which other users n8n still lets sign in with a password.

Detection Strategy

• Reads the sign-in method of the instance from its public settings, which answer without the API key, and lists every user through the n8n public API with the user:list scope, never their names or emails

• Reports a vulnerability for each user who has signed up and has n8n multi-factor authentication turned off; a pending invitation is never reported, and on an instance that signs in through SAML or OIDC only the owner is evaluated, so a user other than the owner whom n8n still lets sign in with a password, an exception the public API does not show, is not reported

• Records in the evidence the sign-in method and, for the user, the ID, role and mfaEnabled; the public API does not show whether an LDAP sync disabled a user, so such a user is reported the same way although n8n refuses their sign-in, and deleting the user in n8n closes the finding; when the API key or the license cannot list users, or the settings cannot be read, the rule is recorded as unreadable rather than reported as clean