How to use this reference
Editorial lesson: retain issuer and subject together throughout external-identity lookup and account binding; successful token validation alone does not establish which local account it represents. OpenID Connect Core section 5.7 supplies conceptual support for issuer-scoped identity. Follow the maintainer's upgrade guidance; reducing trusted issuers or disabling unused exchange is explicitly incomplete temporary mitigation.
Before reading
- Basic federation, token claims and local-account binding concepts
Context and limits
- Patched metadata lists >= 2.27.4 and >= 2.28.1, while remediation prose names 2.28.1. The overlapping affected entries < 2.27.4 and < 2.28.1 are preserved as published; no normalized affected interval is inferred.
- Release pages date both versions to June 24, 2026; 2.28.1 is labeled pre-release. They do not identify this fix and support chronology only, not independent patch verification.
- Jubke published the advisory; bearsyankees is credited as Reporter. No narrative byline or individual award is established.
- OpenID Connect Core's displayed December 15, 2023 edition is a conceptual reference, not this advisory's publication date or a claim that n8n violates an OIDC conformance requirement.
- This issuer-namespace case differs from the library's LDAP attribute linking, refresh-grant resource binding, Dynamic Credentials ownership, Prowler tenant selection and multi-app OAuth binding examples.
Sources and provenance
- Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution n8n · reviewed 2026-10-05
- n8n@2.27.4 release n8n · reviewed 2026-10-05
- n8n@2.28.1 release n8n · reviewed 2026-10-05
- OpenID Connect Core 1.0 incorporating errata set 2, section 5.7 OpenID Foundation · reviewed 2026-10-05
Record reviewed 2026-10-05. Snapshot cb017eaea66e. Open the complete JSON contract.