CVE-2026-82274: Twenty Open Redirect via OAuth Propagator Callback
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when ISMULTIWORKSPACEENABLED is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Twentyto a version that resolves this vulnerability.Fixed in 2.35.0
Event History
Frequently Asked Questions
Which deployments are exposed to the domain-validation bypass?
The bypass is described as occurring when IS_MULTIWORKSPACE_ENABLED is disabled. Twenty versions through 2.35.0 are affected.
What does an attacker need to exploit this issue?
An attacker can craft a malicious request using a state query parameter that contains an arbitrary redirect URL. Exploitation requires user interaction, as indicated by the UI:R attack vector.
What is the impact of a successful exploit?
A successful attack can redirect a user to an attacker-controlled host while forwarding OAuth authorization codes. The supplied vector indicates low confidentiality impact and no integrity or availability impact.