Open Redirect Vulnerability in Twenty by TwentyHQ

CVE-2026-82274

What is CVE-2026-82274?

The Twenty application by TwentyHQ is susceptible to an open redirect vulnerability within the OAuthPropagatorController.propagateOAuthCallback endpoint. This security flaw allows attackers to manipulate the state query parameter, leading to the potential for arbitrary redirection of users. By crafting malicious requests, attackers can redirect users to unintended sites while simultaneously forwarding OAuth authorization codes. This bypasses essential domain validation checks when the IS_MULTIWORKSPACE_ENABLED feature is turned off, posing risks related to unauthorized access to sensitive user data and credentials.

References