Open Redirect in Twentyhq Twenty
CVE-2026-82274
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
Vulnerability class: Open Redirect
CVSS v3 metric
CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- disclosure@vulncheck.com (issue-tracking)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (technical-description)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2026-82274?
- CVE-2026-82274 is a medium-severity vulnerability in Twentyhq Twenty, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.7/10. Published 2026-08-28.
- How severe is CVE-2026-82274?
- Medium severity. CVSS v3 base score is 4.7 out of 10.