medium4.7
CVE-2026-82274
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query para…
Impact
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
Affected products
| Product | Affected versions |
|---|---|
| Twenty | through 2.35.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/twentyhq/twenty
- https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts
- https://github.com/twentyhq/twenty/issues/22109
- https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback
- https://github.com/twentyhq/twenty/issues/22109