CVE-2026-82274
MEDIUM
NVD
CVSS Score
4.7
Severity
MEDIUM
Published
Aug 28, 2026
Vendor
unknown
Description
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
References
- https://github.com/twentyhq/twenty
- https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts
- https://github.com/twentyhq/twenty/issues/22109
- https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback
- https://github.com/twentyhq/twenty/issues/22109