AIKIDO-2026-675877

TL;DR

n8n's Dynamic Credentials feature generates OAuth authorization links for end-user credential connections through the dynamic-credentials.ee authorize endpoint. The generated authorization token is not bound to the user who initiated it, so a different authenticated user who obtains the link can complete the OAuth flow and bind their own credential into the initiator's account. This lets one user hijack or pollute another user's credential connection, so later workflow executions run under an unintended OAuth identity. The fix binds the initiating userId to the authorization intent and rejects unauthenticated or mismatched users, failing closed when ownership cannot be resolved.