CVE-2026-82274: falha de média gravidade em twentyhq twenty
Twenty Open Redirect via OAuth Propagator Callback
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.4%
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
twentyhq · twentyCVEs relacionadas — twentyhq twenty
No mesmo produto, das mais perigosas para as menos.
CVE-2026-73069CRITICALTwenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL ExecutionEPSS 0.7%CVE-2026-46624CRITICALTwenty: SQL Injection via the timeZone fieldEPSS 0.5%CVE-2026-92771HIGHTwenty before 2.35.0 Permission Bypass via groupBy-with-records QueryEPSS 0.4%CVE-2026-85055HIGHTwenty: Field-level read bypassEPSS 0.4%CVE-2026-35451MEDIUMTwenty: Stored XSS via BlockNote FileBlockEPSS 0.3%CVE-2026-105763CRITICALTwenty: Plaintext IMAP/SMTP/CalDAV password disclosure to any workspace member via /metadata GraphQLEPSS 0.3%
Referências
https://github.com/twentyhq/twentyhttps://github.com/twentyhq/twenty/blob/5851753d0cad4678af94382899d371203d651acb/packages/twenty-server/src/engine/core-modules/auth/controllers/oauth-propagator.controller.tshttps://github.com/twentyhq/twenty/issues/22109https://www.vulncheck.com/advisories/twenty-open-redirect-via-oauth-propagator-callback