Description

Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-28T20:20:18.367Z",
  "pubdate": "2026-08-28T20:20:18.367Z",
  "executiveSummary": "The Twenty platform (versions through 2.35.0) contains an open redirect vulnerability located within the OAuthPropagatorController.propagateOAuthCallback endpoint.\nThe vulnerability stems from improper validation of the 'state' query parameter, which is incorrectly handled as a destination URL for post-authentication redirection.\nWhen IS_MULTIWORKSPACE_ENABLED is set to false, the application fails to perform adequate domain validation, allowing an attacker to coerce the system into redirecting authenticated users to arbitrary, attacker-controlled hosts.\nThis vulnerability facilitates phishing, social engineering, and the potential exfiltration of sensitive OAuth authorization codes.\nBy crafting a malicious request, an attacker can redirect an unsuspecting user to a third-party domain while simultaneously forwarding the authorization code, thereby subverting the intended OAuth flow security controls.\nThe risk is elevated due to the potential for attackers to gain unauthorized access to user sessions or credentials by intercepting redirected traffic.",
  "technicalDetails": "The vulnerability exists in the OAuthPropagatorController.propagateOAuthCallback method, which is responsible for processing OAuth authorization callbacks.\nThe root cause is an insecure implementation of the redirect logic where the 'state' query parameter is parsed and treated as a trusted destination URL instead of an opaque identifier intended for CSRF protection or session tracking.\nUnder normal operations, the OAuth flow utilizes the 'state' parameter to maintain integrity between the authorization request and the callback.\nHowever, when the application configuration IS_MULTIWORKSPACE_ENABLED is disabled, the system bypasses domain whitelist validation, allowing the application to redirect the user agent to any URI provided within the state parameter.\nExploitation follows a specific attack flow: First, an attacker crafts a malicious URL pointing to the vulnerable propagateOAuthCallback endpoint, injecting an arbitrary URL into the 'state' parameter. Second, the attacker induces a victim, who may be currently authenticating via OAuth, to interact with the crafted request. Third, upon successful authentication, the server processes the callback and, instead of redirecting the user to a legitimate internal resource, it instructs the user agent to navigate to the attacker-supplied URL.\nCrucially, the server includes the OAuth authorization code in the redirect payload, effectively sending the authorization credentials to the attacker's server.\nThis behavior exposes users to credential interception, as the attacker can capture the authorization code from their own server logs and subsequently exchange it for an access token, assuming the attacker can also fulfill the client secret requirements of the OAuth flow.\nThe vulnerability is accessible to unauthenticated remote attackers capable of social engineering a user to click the crafted link. It does not require special privileges within the Twenty application to initiate, as the exploitation relies on the victim's legitimate OAuth session state.\nThe exposure is strictly network-based and contingent on the application's global configuration, specifically the disabled status of multi-workspace functionality."
}