Self-hosted n8n before 2.41.4: 26 September advisories with no CVE IDs

In September 2026 n8n published three batches of security advisories, two of them without CVE IDs and absent from OSV.dev and the GitHub Advisory Database. npm audit, Dependabot and OSV-Scanner report vulnerable versions as clean; fixes are in 2.41.4 (stable), 2.42.1 (beta) and 1.123.83 (1.x).

• 30 September batch: 14 advisories, 10 rated high, fixed in 2.41.4, 2.42.1 and 1.123.83
• GHSA-3qcw-p65v-c7vq (CVSS 8.2): OAuth clients stored via authorize endpoint without login
• GHSA-4c7j-qff5-r9cx: dynamic webhook paths matched by path alone, runs another project's workflow
• GHSA-x5cw-hm7v-q7mj: Chat Trigger custom CSS allows stored XSS on hosted chat pages