CVE-2026-82274
Twenty Open Redirect via OAuth Propagator Callback
CVSS Score
4.7
EPSS Score
0.0%
EPSS Percentile
0th
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
| CWE | CWE-601 |
| Vendor | twentyhq |
| Product | twenty |
| Published | Aug 28, 2026 |
| Last Updated | Aug 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for twentyhq twenty
Be the first to know when new medium vulnerabilities affecting twentyhq twenty are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
twentyhq / twenty
0 ≤ 2.35.0
References
github.com: https://github.com/twentyhq/twenty/issues/22109 github.com: https://github.com/twentyhq/twenty github.com: https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts vulncheck.com: https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback
Credits
🔍 George Chen