CVE-2026-82274: Twenty open redirect in OAuth callback handler

Executive brief

Twenty is a Salesforce alternative used to manage customer data and workflows. The OAuthPropagatorController endpoint allows attackers to redirect users to malicious websites while forwarding OAuth authorization codes, potentially enabling credential theft and account takeover. This vulnerability affects deployments where multi-workspace mode is disabled.

Technical details

The vulnerability is an open redirect flaw in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL without proper validation. When IS_MULTIWORKSPACE_ENABLED is disabled, domain validation is bypassed, allowing attackers to craft malicious OAuth requests that redirect users to arbitrary hosts while forwarding authorization codes. The attack requires crafting a malicious request but does not require prior authentication. An attacker can exploit this to perform phishing attacks and intercept OAuth tokens.

Affected products

• Twenty Twenty through 2.35.0

Timeline

• 2026-08-28: disclosed

References

• https://github.com/twentyhq/twenty
• https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts