CVE-2026-82274: Twenty OAuth Open Redirect Vulnerability

CVE-2026-82274 Overview

CVE-2026-82274 is an open redirect vulnerability [CWE-601] affecting Twenty through version 2.35.0. The flaw resides in the OAuthPropagatorController.propagateOAuthCallback endpoint, which treats the state query parameter as a redirect URL without adequate validation. Attackers can craft malicious OAuth callback requests that forward users to arbitrary external hosts. The redirect also carries the OAuth authorization code, exposing credentials to attacker-controlled destinations. Domain validation is bypassed when IS_MULTIWORKSPACE_ENABLED is disabled, expanding the exploitable surface for single-workspace deployments. The vulnerability requires user interaction, typically through a phishing link that appears to originate from a trusted Twenty instance.

Critical Impact
Attackers can hijack OAuth authorization codes and redirect authenticated users to attacker-controlled hosts, enabling phishing and account takeover.

Affected Products

Twenty CRM through version 2.35.0
Twenty deployments with IS_MULTIWORKSPACE_ENABLED disabled
Self-hosted Twenty instances exposing the OAuthPropagatorController endpoint

Discovery Timeline

2026-08-28 - CVE-2026-82274 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82274

Vulnerability Analysis

Twenty is an open-source customer relationship management (CRM) platform. The OAuthPropagatorController.propagateOAuthCallback endpoint handles OAuth callbacks and uses the state query parameter as a redirect target. The controller does not verify that the redirect destination matches an allow-list of trusted hosts. When IS_MULTIWORKSPACE_ENABLED is set to false, the workspace-domain validation path is skipped entirely, allowing any absolute URL supplied in state to become the redirect target.

Because the OAuth authorization code is appended to the outbound redirect, an attacker who lures a victim to a crafted callback URL receives both the redirect and the authorization code. The attacker can then complete the OAuth token exchange from their own infrastructure, depending on the OAuth client configuration. The issue is tracked as GitHub Issue #22109 and detailed in the VulnCheck Advisory on Open Redirect.

Root Cause

The root cause is missing validation of user-controlled redirect input, classified as [CWE-601] URL Redirection to Untrusted Site. The state parameter, which OAuth specifications intend as an anti-CSRF opaque token, is repurposed as a redirect URL in the vulnerable OAuth Propagator Controller code. The domain validation logic gates on IS_MULTIWORKSPACE_ENABLED, leaving single-workspace configurations without protection.

Attack Vector

An attacker crafts a phishing URL pointing to a legitimate Twenty instance's OAuth propagator callback with a state parameter set to an attacker-controlled URL. The victim clicks the link and completes OAuth authentication with the trusted provider. The Twenty server redirects the victim to the attacker's host, forwarding the OAuth authorization code in the URL. The attacker captures the code from server logs or referrer headers. Exploitation requires user interaction but no authentication on the Twenty instance itself.

No verified public exploit code is available. See the VulnCheck advisory for technical details.

Detection Methods for CVE-2026-82274

Indicators of Compromise

Access log entries to /auth/oauth/propagate/callback (or equivalent propagator route) containing absolute URLs in the state query parameter pointing to external domains.
HTTP 302 redirects from Twenty instances to hosts outside the organization's OAuth trust boundary.
Referrer headers in outbound web traffic containing OAuth code values leaving the Twenty host.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the OAuth propagator callback where state decodes to a URL with a scheme and hostname rather than an opaque token.
Correlate outbound network telemetry with OAuth callback events to identify redirects to previously unseen external domains.
Alert on user-agent chains that traverse identity provider callbacks and terminate at non-corporate hostnames.

Monitoring Recommendations

Monitor Twenty application logs for anomalous state parameter contents, especially values matching URL patterns.
Track OAuth authorization code issuance and correlate with the final redirect destination to detect code leakage.
Enable phishing telemetry on email gateways to detect crafted links referencing legitimate Twenty domains with suspicious state payloads.

How to Mitigate CVE-2026-82274

Immediate Actions Required

Upgrade Twenty to a version later than 2.35.0 once a fixed release is published by the maintainers.
Restrict external exposure of the Twenty OAuth propagator callback endpoint through a reverse proxy or web application firewall until patched.
Rotate any OAuth client secrets and revoke active authorization codes if suspicious callback activity is observed.

Patch Information

At the time of publication, monitor the Twenty GitHub repository and GitHub Issue #22109 for the official fix. The remediation should enforce strict allow-list validation of redirect destinations independent of the IS_MULTIWORKSPACE_ENABLED flag, and should not use the state parameter as a redirect target.

Workarounds

Enable IS_MULTIWORKSPACE_ENABLED where operationally feasible to activate the workspace-domain validation path.
Deploy a web application firewall rule that rejects requests to the OAuth propagator callback when the state parameter contains http://, https://, or // prefixes.
Apply a reverse proxy filter that strips or validates the state query parameter against a hardcoded allow-list of internal hostnames.

bash

# Example NGINX rule to block absolute URLs in the state parameter
location ~ ^/auth/oauth/propagate/callback {
    if ($arg_state ~* "^(https?:)?//") {
        return 400;
    }
    proxy_pass http://twenty_backend;
}