CVE-2026-82274: URL Redirection to Untrusted Site ('Open Redirect') in twentyhq twenty

CVE-2026-82274 is an open redirect vulnerability in the twentyhq twenty product affecting versions up to 2.35.0. The issue exists in the OAuthPropagatorController.propagateOAuthCallback endpoint, which improperly treats the state query parameter as a redirect URL without sufficient validation. When the IS_MULTIWORKSPACE_ENABLED configuration is disabled, attackers can exploit this to redirect users to arbitrary external hosts while forwarding OAuth authorization codes, effectively bypassing domain validation controls.

An attacker can use this vulnerability to redirect users to malicious websites, potentially facilitating phishing or other social engineering attacks. The forwarding of OAuth authorization codes during the redirect could increase the risk of unauthorized access or token interception. However, the vulnerability requires user interaction (UI:P) and has a low vector complexity (AC:L). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider enabling IS_MULTIWORKSPACE_ENABLED if feasible, as this setting affects the vulnerability's exploitability. Avoid clicking on untrusted links that may exploit this open redirect.