# Check n8n webhooks and forms for missing authentication

**Use case:** 

Find Webhook nodes that accept requests from anyone who learns the URL, with no authentication set and no IF, Switch, Filter or Code node wired directly after them to reject unknown callers. Also flags Form Trigger input that flows into an n8n expression downstream, which is the workflow shape CVE-2026-27493 exploits. One row per exposed entry point, each with the fix.

## Input

```json
{
  "workflowJson": {
    "name": "Public intake webhook",
    "nodes": [
      {
        "id": "1",
        "name": "Order webhook",
        "type": "n8n-nodes-base.webhook",
        "typeVersion": 2,
        "position": [
          0,
          0
        ],
        "webhookId": "b7c2f1e0-11aa-4c33-9d55-7e0f2a4b8c91",
        "parameters": {
          "path": "orders",
          "httpMethod": "POST",
          "responseMode": "onReceived"
        }
      },
      {
        "id": "2",
        "name": "Create order in CRM",
        "type": "n8n-nodes-base.httpRequest",
        "typeVersion": 4.2,
        "position": [
          240,
          0
        ],
        "parameters": {
          "url": "=https://crm.internal/api/orders/{{ $json.body.customerId }}",
          "method": "POST",
          "options": {
            "timeout": 15000
          }
        }
      },
      {
        "id": "3",
        "name": "Contact form",
        "type": "n8n-nodes-base.formTrigger",
        "typeVersion": 2.2,
        "position": [
          0,
          220
        ],
        "webhookId": "f31a9c48-6d20-4a11-b8e7-c25d90fa4471",
        "parameters": {
          "formTitle": "Contact us",
          "formFields": {
            "values": [
              {
                "fieldLabel": "Email"
              },
              {
                "fieldLabel": "Message"
              }
            ]
          }
        }
      },
      {
        "id": "4",
        "name": "Build ticket subject",
        "type": "n8n-nodes-base.set",
        "typeVersion": 3.4,
        "position": [
          240,
          220
        ],
        "parameters": {
          "assignments": {
            "assignments": [
              {
                "id": "a",
                "name": "subject",
                "type": "string",
                "value": "=New message from {{ $json.Email }}: {{ $json.Message }}"
              }
            ]
          }
        }
      },
      {
        "id": "5",
        "name": "Email support",
        "type": "n8n-nodes-base.emailSend",
        "typeVersion": 2.1,
        "position": [
          480,
          220
        ],
        "parameters": {
          "subject": "={{ $json.subject }}",
          "toEmail": "support@internal.test"
        },
        "credentials": {
          "smtp": {
            "id": "9",
            "name": "SMTP account"
          }
        }
      }
    ],
    "connections": {
      "Order webhook": {
        "main": [
          [
            {
              "node": "Create order in CRM",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Contact form": {
        "main": [
          [
            {
              "node": "Build ticket subject",
              "type": "main",
              "index": 0
            }
          ]
        ]
      },
      "Build ticket subject": {
        "main": [
          [
            {
              "node": "Email support",
              "type": "main",
              "index": 0
            }
          ]
        ]
      }
    },
    "settings": {
      "errorWorkflow": "err-1"
    }
  },
  "workflowUrls": [],
  "workflowIds": [],
  "activeOnly": false,
  "ruleSet": "security",
  "minSeverity": "low",
  "ignoreRules": [],
  "includeReport": false
}
```

## Output

```json
{
  "severity": {
    "label": "Severity",
    "format": "string"
  },
  "rule": {
    "label": "Rule ID",
    "format": "string"
  },
  "ruleTitle": {
    "label": "Rule",
    "format": "string"
  },
  "category": {
    "label": "Category",
    "format": "string"
  },
  "workflowName": {
    "label": "Workflow",
    "format": "string"
  },
  "nodeName": {
    "label": "Node",
    "format": "string"
  },
  "nodeType": {
    "label": "Node type",
    "format": "string"
  },
  "message": {
    "label": "Finding",
    "format": "string"
  },
  "parameterPath": {
    "label": "Parameter",
    "format": "string"
  },
  "evidence": {
    "label": "Evidence (masked)",
    "format": "string"
  },
  "remediation": {
    "label": "How to fix",
    "format": "string"
  },
  "docsUrl": {
    "label": "Docs",
    "format": "string"
  }
}
```

## About this Actor

This example demonstrates how to use [n8n Workflow Auditor - Linter & Security Review](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) with a specific input configuration. Visit the [Actor detail page](https://apify.com/mediocre_interest/n8n-workflow-auditor.md) to learn more, explore other use cases, and run it yourself.


## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
This Task's input is already configured above — use it as-is rather than inventing a new one.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For full API examples (JavaScript, Python, CLI, MCP, OpenAPI), see this Task's Actor page: https://apify.com/mediocre_interest/n8n-workflow-auditor.md

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).