{"id":"CVE-2026-82274","title":"Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL","summary":"Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect us…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N","cwe":["CWE-601"],"published":"2026-08-28","updated":"2026-09-23","sourceUpdated":"2026-09-23T17:17:43.700","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82274","references":[{"url":"https://github.com/twentyhq/twenty","label":"disclosure@vulncheck.com"},{"url":"https://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.ts","label":"disclosure@vulncheck.com"},{"url":"https://github.com/twentyhq/twenty/issues/22109","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback","label":"disclosure@vulncheck.com"},{"url":"https://github.com/twentyhq/twenty/issues/22109","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00222,"epssPercentile":0.12993,"ingestedAt":"2026-09-23T17:28:14.813Z","slug":"CVE-2026-82274","body":"## Overview\n\nTwenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}