www.strix.ai
Saved Bookmark
Description
Strix pointed itself at n8n's token-exchange flow and found an identity-binding bug: two trusted issuers emitting the same sub map to the same local account. One trusted token could log you in as someone else.
www.strix.ai
Technology
Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8n - Strix
Strix pointed itself at n8n's token-exchange flow and found an identity-binding bug: two trusted issuers emitting the same sub map to the same local account. One trusted token could log you in as someone else.