VYPR
← All advisories
High severityNVD Advisory· Published May 10, 2023· Updated Jan 27, 2025

CVE-2023-27564

CVE-2023-27564

Description

The n8n package 0.218.0 for Node.js allows Information Disclosure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

n8n before 0.216.1 allows information disclosure due to an authentication bypass on URLs containing .svg files.

Vulnerability

CVE-2023-27564 affects n8n, a workflow automation platform, in versions up to 0.218.0. The root cause is that authentication was explicitly bypassed for URLs containing .svg in the path. This allowed unauthenticated access to endpoints that should have required authentication [1][3].

Exploitation

An attacker can exploit this by crafting a request to any protected endpoint with .svg appended to the URL path. No authentication or prior access is needed. For example, accessing /users?file.svg would bypass authentication checks [2][3].

Impact

Successful exploitation leads to information disclosure, potentially exposing sensitive data such as user details, workflow configurations, or credentials stored within the n8n instance [2].

Mitigation

The vulnerability was fixed in n8n version 0.216.1, released on February 21, 2023. Users should upgrade to at least this version [1][3].

References
  1. Release n8n@0.216.1 · n8n-io/n8n
  2. NVD - CVE-2023-27564
  3. fix(core): Do not explicitly bypass auth on urls containing `.svg` by netroy · Pull Request #5525 · n8n-io/n8n

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
n8nnpm
< 0.216.10.216.1

Affected products

2
  • n8n/n8ndescription
  • ghsa-coords
    pkg:npm/n8n
    Range: < 0.216.1

Patches

1
27adea704593

fix(core): Do not explicitly bypass auth on urls containing `.svg` (#5525)

https://github.com/n8n-io/n8nकारतोफ्फेलस्क्रिप्ट™Feb 21, 2023via ghsa
commit
1 file changed · +7 −7
  • packages/cli/src/middlewares/auth.ts+7 −7 modified
    @@ -3,11 +3,12 @@ import jwt from 'jsonwebtoken';
 import cookieParser from 'cookie-parser';
 import passport from 'passport';
 import { Strategy } from 'passport-jwt';
+import { sync as globSync } from 'fast-glob';
 import { LoggerProxy as Logger } from 'n8n-workflow';
 import type { JwtPayload } from '@/Interfaces';
 import type { AuthenticatedRequest } from '@/requests';
 import config from '@/config';
-import { AUTH_COOKIE_NAME } from '@/constants';
+import { AUTH_COOKIE_NAME, EDITOR_UI_DIST_DIR } from '@/constants';
 import { issueCookie, resolveJwtContent } from '@/auth/jwt';
 import {
 	isAuthenticatedRequest,
@@ -61,6 +62,10 @@ const refreshExpiringCookie: RequestHandler = async (req: AuthenticatedRequest,
 
 const passportMiddleware = passport.authenticate('jwt', { session: false }) as RequestHandler;
 
+const staticAssets = globSync(['**/*.html', '**/*.svg', '**/*.png', '**/*.ico'], {
+	cwd: EDITOR_UI_DIST_DIR,
+});
+
 /**
  * This sets up the auth middlewares in the correct order
  */
@@ -79,12 +84,7 @@ export const setupAuthMiddlewares = (
 			// TODO: refactor me!!!
 			// skip authentication for preflight requests
 			req.method === 'OPTIONS' ||
-			req.url === '/index.html' ||
-			req.url === '/favicon.ico' ||
-			req.url.startsWith('/css/') ||
-			req.url.startsWith('/js/') ||
-			req.url.startsWith('/fonts/') ||
-			req.url.includes('.svg') ||
+			staticAssets.includes(req.url.slice(1)) ||
 			req.url.startsWith(`/${restEndpoint}/settings`) ||
 			req.url.startsWith(`/${restEndpoint}/login`) ||
 			req.url.startsWith(`/${restEndpoint}/logout`) ||

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.