Description
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| twentyhq | twenty | ≤ 2.35.0 | — |
References
- GitHub Issue #22109 issue-tracking
- https://github.com/twentyhq/twenty product
- Vulnerable code: oauth-propagator.controller.ts technical-description
- VulnCheck Advisory: Twenty Open Redirect via OAuth Propagator Callback third-party-advisory