CVE-2026-82274 twentyhq CVE debrief

Who should care

Defenders responsible for the security of Twenty deployments, especially those using versions up to 2.35.0, should assess their exposure to this vulnerability. They should verify if IS_MULTIWORKSPACE_ENABLED is disabled in their environments and prioritize validating redirect URLs to prevent potential open redirect attacks.

Why it matters

CVE-2026-82274 is a medium-severity open redirect vulnerability in Twenty that allows attackers to redirect users to arbitrary hosts. Defenders should prioritize verifying affected versions, monitoring for suspicious requests, and implementing additional redirect URL validation to prevent potential attacks.

• Defenders need to verify the affected versions and configurations of the OAuthPropagatorController in their environments.
• They should monitor for suspicious redirect requests that could indicate exploitation attempts.
• Implementing additional validation for redirect URLs can prevent open redirect attacks.
• The vulnerability's impact on OAuth authorization codes needs to be assessed and mitigated.

Technical summary

The OAuthPropagatorController.propagateOAuthCallback endpoint in Twenty through 2.35.0 is vulnerable to open redirect attacks. The state query parameter is treated as a redirect URL, allowing attackers to craft malicious requests that redirect users to arbitrary hosts while forwarding OAuth authorization codes. This bypasses domain validation when IS_MULTIWORKSPACE_ENABLED is disabled. Defenders should prioritize verifying the affected versions and configurations of the OAuthPropagatorController in their environments, especially when IS_MULTIWORKSPACE_ENABLED is disabled. They should also monitor for any suspicious redirect requests and implement additional validation for redirect URLs to prevent potential open

Defensive priority

Defenders should prioritize verifying the affected versions and configurations of the OAuthPropagatorController in their environments, especially when IS_MULTIWORKSPACE_ENABLED is disabled. They should also monitor for any suspicious redirect requests and implement additional validation for redirect URLs.

Recommended defensive actions

• Verify the configurations of the OAuthPropagatorController in your environment, especially when IS_MULTIWORKSPACE_ENABLED is disabled.
• Implement additional validation for redirect URLs to prevent open redirect attacks.
• Monitor for suspicious redirect requests that could be indicative of exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and affected versions. However, the exact versions that are affected or fixed are not specified in the provided information. The vendor and product names are also not clearly identified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.