CVE-2026-82274
MediumCVSS 4.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
Risk Assessment
An attacker could redirect users to malicious sites, potentially leading to credential theft or other phishing attacks.
Recommendation
Update Twenty to a version that includes redirect validation fixes. Additionally, enable IS_MULTIWORKSPACE_ENABLED if possible and monitor unusual OAuth requests.
Other vulnerabilities in Twenty
See all- CVE-2026-73069Critical
Twenty before 2.15.0 allows a workspace administrator with DATA_MODEL permission to supply an unescaped expression for the TS_VECTOR field, leading to SQL injection and arbitrary PostgreSQL execution as the application user.
- CVE-2026-33975High
Twenty (open source CRM) versions 1.18.0 and earlier have an SSRF vulnerability where protection in SecureHttpClientService can be bypassed using IPv4-mapped IPv6 addresses in URL IP literals. Node.js normalizes such addresses to compressed hex form, but the isPrivateIp function only recognizes dotted-decimal notation.
Original NVD description (English source)
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.