# CVE-2026-82274: Twenty open redirect in OAuth callback handler

Source: https://junglewise.ai/threats/cve-2026-82274-twenty-open-redirect-in-oauth-callback-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82274 · Severity: medium · CVSS 4.7 · Published 2026-08-28

Twenty is a Salesforce alternative used to manage customer data and workflows. The OAuthPropagatorController endpoint allows attackers to redirect users to malicious websites while forwarding OAuth authorization codes, potentially enabling credential theft and account takeover. This vulnerability affects deployments where multi-workspace mode is disabled.

Technologies: [Twenty](https://junglewise.ai/threats/technologies/twenty). Vendors: [Twenty](https://junglewise.ai/threats/vendors/twenty).

## Quick answers

**Is CVE-2026-82274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82274 being exploited in the wild.

**How severe is CVE-2026-82274?** Medium severity, with a CVSS score of 4.7, published 28 August 2026.

**Which products and versions are affected?** Twenty through 2.35.0.

**Is there a fix for CVE-2026-82274?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82274 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-82274?** Check whether you run Twenty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an open redirect flaw in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL without proper validation. When IS_MULTIWORKSPACE_ENABLED is disabled, domain validation is bypassed, allowing attackers to craft malicious OAuth requests that redirect users to arbitrary hosts while forwarding authorization codes. The attack requires crafting a malicious request but does not require prior authentication. An attacker can exploit this to perform phishing attacks and intercept OAuth tokens.

## Affected products

- Twenty Twenty through 2.35.0

## Timeline

- 2026-08-28: disclosed

## References

- [https://github.com/twentyhq/twenty](https://github.com/twentyhq/twenty)
- [https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts](https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts)

## Related threats

- [Twenty CRM credential disclosure in GraphQL metadata query](https://junglewise.ai/threats/cve-2026-105763-twenty-is-an-open-source-crm-customer-relationship-management)
- [Twenty CRM field-level permission bypass in filters](https://junglewise.ai/threats/cve-2026-85055-twenty-is-an-open-source-crm-customer-relationship-management)
- [Twenty GraphQL permission bypass in groupBy-with-records resolver](https://junglewise.ai/threats/cve-2026-92771-twenty-graphql-permission-bypass-in-groupby-with-records-resolver)
- [Twenty CRM SQL injection in search vector field configuration](https://junglewise.ai/threats/cve-2026-73069-twenty-crm-sql-injection-in-search-vector-field-configuration)
- [Twenty CRM IDOR in AI Agent Monitor](https://junglewise.ai/threats/cve-2026-55583-twenty-crm-idor-in-ai-agent-monitor)