CVE-2025-68613/
│
├── cve-2025-68613.py
└── README.md

python3 cve-2025-68613.py -u https://127.0.0.1 -p 443 --insecure

n8n CVE-2025-68613 Vulnerability Scanner
----------------------------------------

[•] Target: https://127.0.0.1:443
[•] Performing version fingerprinting...
[✓] Detected n8n version: 1.120.0
[!] Vulnerable to CVE-2025-68613

[✓] Target is NOT vulnerable. No further action required.

python cve-2025-68613.py -u 127.0.0.1 -p 443 --poc -v -k

python cve-2025-68613.py -u 127.0.0.1 -p 443 --poc -v -k
n8n CVE-2025-68613 Vulnerability Scanner
------------------------------------------

[•] Target: https://127.0.0.1:443

[•] Performing version fingerprinting...
[DEBUG] Fetching: https://127.0.0.1:443/signin
[✓] Detected n8n version: 1.120.0
[!] Vulnerable to CVE-2025-68613

[•] Running SAFE PoC to validate exposure...

[DEBUG] Querying settings: https://127.0.0.1:443/rest/settings
[✓] SAFE POC CONFIRMED
The instance exposes internal configuration without authentication.
This correlates with weakened backend isolation seen in vulnerable builds.

--- Metadata Fragment (Pretty Printed) ---
{
  "data": {
    "authCookie": {
      "secure": true
    },
    "banners": {
      "dismissed": [
        "V1"
      ]
    },
    "defaultLocale": "en",
    "enterprise": {
      "ldap": false,
      "oidc": false,
      "saml": false,
      "showNonProdBanner": false
    },
    "instanceId": "ab12eeb1234d5a12ee12c123caa86aca12345fc1234567fbc3e29b6e12f123cd",
    "mfa": {
      "enabled": true,
      "enforced": false
    },
    "oauthCallbackUrls": {
      "oauth1": "http://0.0.0.0:5678/rest/oauth1-credential/callback",
      "oauth2": "http://0.0.0.0:5678/rest/oauth2-credential/callback"
    },
    "previewMode": false,
    "releaseChannel": "dev",
    "settingsMode": "public",
    "sso": {
      "ldap": {
        "loginEnabled": false,
        "loginLabel": ""
      },
      "oidc": {
        "callbackUrl": "http://0.0.0.0:5678/rest/sso/oidc/callback",
        "loginEnabled": false,
        "loginUrl": "http://0.0.0.0:5678/rest/sso/oidc/login"
      },
      "saml": {
        "loginEnabled": false,
        "loginLabel": ""
      }
    },
    "telemetry": {
      "config": {
        "key": "1zAn2bcDEz3Fc4p5Gh6uiJ7KLMn",
        "proxy": "http://0.0.0.0:5678/rest/telemetry/proxy",
        "sourceConfig": "http://0.0.0.0:5678/rest/telemetry/rudderstack",
        "url": "https://telemetry.n8n.io"
      },
      "enabled": true
    },
    "userManagement": {
      "authenticationMethod": "email",
      "quota": -1,
      "showSetupOnFirstLoad": false,
      "smtpSetup": false
    },
    "versionCli": "1.120.0",
    "versionNotifications": {
      "enabled": true,
      "endpoint": "https://api.n8n.io/api/versions/",
      "infoUrl": "https://docs.n8n.io/hosting/installation/updating/",
      "whatsNewEnabled": true,
      "whatsNewEndpoint": "https://api.n8n.io/api/whats-new"
    }
  }
}

python3 cve-2025-68613.py -u https://n8n.lab -p 5678 --poc --insecure