Medium severity · published Aug 28, 2026
CVE-2026-82274
Twenty Open Redirect via OAuth Propagator Callback
4.7
CVSS
0.4%
EPSS
No
On KEV
Description
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TW
twenty · twentyhq
through 2.35.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82274
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82274
github.com
https://github.com/twentyhq/twenty
github.com
https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts
github.com
https://github.com/twentyhq/twenty/issues/22109
www.vulncheck.com
https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback
More from twenty
9.9
CVE-2026-46624
Twenty: SQL Injection via the timeZone field
9.6
CVE-2026-105763
Twenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQL
9.1
CVE-2026-73069
Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
8.7
CVE-2026-44729
Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers)
8.3
CVE-2026-33975
twenty-server SSRF protection bypass via IPv4-mapped IPv6 address normalization