What is CVE-2026-82274?

CVE-2026-82274 is a medium-severity vulnerability in Twentyhq Twenty, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.7/10. Published 2026-08-28.

How severe is CVE-2026-82274?

Medium severity. CVSS v3 base score is 4.7 out of 10.

Open Redirect in Twentyhq Twenty

CVE-2026-82274

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.

Vulnerability class: Open Redirect

Published 2026-08-28 · last modified 2026-09-23.

CVSS v3 metric

CVSS v3 base score 4.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.003 (18.7th percentile), scored 2026-10-13.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 19th percentile — 18.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

Twentyhq Twenty

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

github.com/twentyhq/twenty/issues/22109 (issue-tracking)
github.com/twentyhq/twenty (product)
github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packag… (technical-description)
www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback (third-party-advisory)

Frequently asked questions

What is CVE-2026-82274?: CVE-2026-82274 is a medium-severity vulnerability in Twentyhq Twenty, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.7/10. Published 2026-08-28.
How severe is CVE-2026-82274?: Medium severity. CVSS v3 base score is 4.7 out of 10.