{"id":"CVE-2026-82274","title":"Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL","summary":"Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect us…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cwe":["CWE-601"],"published":"2026-08-28","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:43.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82274","references":[{"url":"https://github.com/twentyhq/twenty","label":"disclosure@vulncheck.com"},{"url":"https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/twentyhq/twenty/issues/22109","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback","label":"disclosure@vulncheck.com"},{"url":"https://github.com/twentyhq/twenty/issues/22109","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00387,"epssPercentile":0.32581,"ingestedAt":"2026-09-23T17:28:14.813Z","vendor":"twentyhq","product":"twenty","affected":["twenty <= 2.35.0"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-28T20:18:50.810516Z"},"slug":"CVE-2026-82274","body":"## Overview\n\nTwenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":38,"depthScoreParts":{"impact":25.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":210244,"id":"CVE-2026-82274","ts":1790264816535,"field":"exploit_available","old":"false","new":"true"}]}