Vulnerability Description
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/twentyhq/twenty
- https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb
- https://github.com/twentyhq/twenty/issues/22109
- https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-c
- https://github.com/twentyhq/twenty/issues/22109
FAQ
What is CVE-2026-82274?
CVE-2026-82274 is a vulnerability with a CVSS score of 4.7 (MEDIUM). Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can cr...
How severe is CVE-2026-82274?
CVE-2026-82274 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82274?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.