CVE-2026-82274

Executive Summary

CVE-2026-82274 is an open redirect vulnerability affecting Twenty CRM versions through 2.35.0. The flaw exists in the OAuthPropagatorController.propagateOAuthCallback endpoint, where the state query parameter is treated as a redirect URL without adequate validation when IS_MULTIWORKSPACE_ENABLED is disabled. A remote attacker can craft malicious OAuth callback requests that redirect victims to arbitrary attacker-controlled hosts, potentially leaking OAuth authorization codes to the attacker's domain. The vulnerability carries a CVSS score of 4.7 (Medium) and remains unpatched, with no vendor fix or workaround currently available.

Technical Analysis

The vulnerability resides in Twenty CRM's OAuth propagation mechanism, specifically within the OAuthPropagatorController.propagateOAuthCallback endpoint. The NVD description indicates that the endpoint incorrectly interprets the state query parameter as a redirect destination URL rather than as opaque state data for CSRF protection or session correlation, which is the standard OAuth 2.0 and OIDC pattern.

Vulnerability Mechanism: In a standard OAuth 2.0 Authorization Code flow, the state parameter is a client-generated opaque value used to maintain state between the authorization request and the callback. The authorization server echoes this parameter back in the redirect to the callback URL, allowing the client to verify that the callback matches a request it initiated. In this implementation, the application instead uses the state parameter to determine where to redirect the user after successful OAuth propagation — effectively converting it into an open redirect primitive.

Attack Surface Context: The critical condition is that domain validation is bypassed when IS_MULTIWORKSPACE_ENABLED is disabled. This configuration flag appears to control multi-tenancy workspace behavior. When disabled (the default or common deployment mode), the application skips or weakens the check that would otherwise restrict redirect destinations to trusted domains. This means an attacker who can control the state parameter can redirect users to any host.

Data Leakage Vector: Because the redirect occurs within the OAuth callback flow, the OAuth authorization code (returned by the OAuth provider as a query parameter on the callback URL) is forwarded along to the redirect target. If an attacker sets the state parameter to their own domain, the victim's browser will be redirected there with the authorization code appended, allowing the attacker to capture it. This authorization code can then be exchanged for an access token at the OAuth provider, granting the attacker the same access level as the victim user.

Root Cause Analysis: The root cause is a failure to distinguish between the two legitimate uses of the state parameter: (1) CSRF/session state verification, and (2) post-authentication redirect targeting. The application conflates these, using the parameter as a redirect URL without validating it against an allowlist of trusted hosts. The conditional bypass when IS_MULTIWORKSPACE_ENABLED is disabled suggests the multi-workspace feature adds additional validation logic (likely a domain whitelist for workspace-specific redirects) that is not applied in single-workspace mode.

CVSS Rationale: The base score of 4.7 reflects: AV:N (network-exploitable), AC:L (no special conditions), PR:N (no privileges required), UI:R (requires victim interaction — clicking a crafted link), S:C (scope change — the vulnerable component impacts a different security scope, i.e., the OAuth provider's tokens), C:L (low confidentiality impact — authorization code leakage), I:N/A:N (no integrity or availability impact).

Exploitation Scenarios

No public PoC is available at the time of writing. The attack chain below is inferred strictly from the NVD description and vulnerability class characteristics (CWE-601).

Step 1 — Reconnaissance / Target Identification: An attacker identifies a Twenty CRM installation running version ≤ 2.35.0. Detection methods include: fingerprinting the Twenty login page, observing the OAuth-enabled SSO configuration (e.g., Google, GitHub, or custom OAuth provider), and querying for the IS_MULTIWORKSPACE_ENABLED configuration state (which may be inferable from the absence of multi-workspace UI elements or from public documentation of default settings). Shodan or similar internet-wide scanning can identify exposed Twenty instances.

Step 2 — Triggering the Flaw: The attacker constructs a malicious URL targeting the OAuthPropagatorController.propagateOAuthCallback endpoint. The URL must include:

• A state parameter set to an attacker-controlled URL (e.g., https://evil.example.com/steal).
• Valid OAuth flow parameters (such as code, scope, and any required PKCE values) that will be populated when the victim authenticates with the legitimate OAuth provider.

The attacker distributes this link via phishing email, social engineering, or by injecting it into a page the victim is likely to visit.

Step 3 — Payload / Execution (Vulnerability-Class Level): When the victim clicks the crafted link, they are directed to the Twenty application's OAuth callback URL with the attacker-controlled state parameter. The application processes the OAuth callback, obtains the authorization code from the OAuth provider, and then — due to the open redirect — sends the victim's browser to the URL stored in state. The authorization code is included in the redirect (either as a query parameter appended to the target URL or in the Referer header, depending on how the application constructs the redirect). The attacker's server receives the authorization code.

Step 4 — Post-Exploitation: The attacker exchanges the intercepted authorization code for an access token at the OAuth provider. The attacker now has the victim's authenticated session to Twenty CRM, with all privileges of the victim account (e.g., reading CRM data, customer records, internal notes, contacts). If the OAuth token grants broader access (e.g., to Google Workspace or GitHub), the blast radius extends beyond Twenty itself. Because the victim's browser has performed the authentication, no phishing credentials are involved — the user is not asked to enter their password anywhere malicious — which makes the attack particularly stealthy.

Chaining Potential: This open redirect can also be chained with other OAuth-related attacks (e.g., token theft via referer leakage, account takeover if the authorization code can be replayed). The attack does not require prior authentication, only the victim's interaction with a crafted link.

Proof of Concept Intelligence

Exploitation Feasibility Without Public PoC: The absence of a published proof-of-concept does not significantly reduce the exploitation risk. The vulnerability class (CWE-601 open redirect) is well understood, and the underlying flaw — treating a state parameter as a redirect URL — is a common OAuth implementation error. An experienced penetration tester or attacker can likely reproduce this without a public PoC by:

1. Deploying a local Twenty CRM instance (or using a test environment).
2. Configuring an OAuth provider (e.g., a test Google OAuth app).
3. Sending a crafted request with state=https://attacker.example.com and observing the redirect behavior.

Resources Defenders Should Monitor:

• Vendor Channels: Twenty's GitHub repository (issues/discussions), official security advisories, release notes for versions following 2.35.0.
• Exploit Databases: Exploit-DB, GitHub Advisory Database, NVD revision history (for patch annotations).
• Threat Intelligence Feeds: Research on similar OAuth implementation bugs in other CRM products; public write-ups on OAuth state-parameter abuse.
• Dark Web / Telegram Channels: Monitor for mentions of "Twenty CRM," "CVE-2026-82274," "OAuth redirect" in threat actor forums (though no current activity is known).
• CISA KEV: Check periodically — while this CVE is not currently on KEV, CISA may add it if in-the-wild exploitation is observed.

Because the vulnerability is unpatched, public disclosure is more likely to result in active exploitation than for a patched CVE. Security teams should assume exploitability until a fix is released.

Impact Assessment

Business Impact: Twenty CRM is an open-source customer relationship management platform. Successful exploitation leads to:

• Confidentiality Breach (Low/Medium): Theft of OAuth authorization codes allows session hijacking. An attacker gains authenticated access to the victim's CRM account, exposing customer data, sales pipelines, internal communications, and personally identifiable information (PII). The CVSS sub-score for confidentiality is Low (0.3 within the base vector), reflecting that only a single user's session is compromised per attack, but the aggregated risk across multiple victims is higher.
• Account Takeover: Depending on the OAuth provider's configuration, the stolen token may persist longer than a session token, giving the attacker continued access even after the victim changes passwords.
• Lateral Movement Potential: If the compromised OAuth account is linked to other services (e.g., Google workspace, GitHub, Slack), the attacker may pivot to those systems. The Scoped metric (S:C) indicates the compromise extends beyond just the vulnerable application.

Affected Systems:

• All Twenty CRM deployments running version 2.35.0 or earlier.
• Only deployments with OAuth authentication enabled AND IS_MULTIWORKSPACE_ENABLED disabled are vulnerable. Deployments with the multi-workspace feature enabled appear to have domain validation that blocks this attack.
• Self-hosted on-premise instances and cloud/managed instances are equally affected if they match the configuration criteria.

Blast Radius:

• Applies to all authenticated OAuth users. A single victim compromise gives the attacker access to that user's CRM data. If the target is an administrator with broader data access, the impact escalates.
• The IS_MULTIWORKSPACE_ENABLED configuration dependency means the actual vulnerable population is a subset of Twenty deployments — reducing the practical blast radius compared to a fully-unconditional open redirect.
• No impact on data integrity or availability was scored (I:N, A:N).

Detection Guidance

The following detection rules target the specific vulnerability mechanism: anomalous redirects from the OAuth callback endpoint to non-trusted hosts. They assume logging of HTTP requests, authentication events, and OAuth flows.

Sigma Rule

title: Twenty CRM OAuth State Parameter Open Redirect Exploitation Attempt
id: 8274aa41-6d4b-4d4a-8b9c-3e09a3b1c2d0
status: experimental
description: Detects attempts to exploit CVE-2026-82274 by sending a state parameter containing a URL to the OAuthPropagatorController.propagateOAuthCallback endpoint.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82274
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: apache
    definition: Requires access to the web server access logs where the query string is logged
detection:
    selection:
        cs-method: GET
        c-uri|contains: 
            - '/OAuthPropagatorController/propagateOAuthCallback'
            - '/oauth/propagate'  # alternative path in case of different routing
        c-uri-query|contains:
            - 'state=http://'
            - 'state=https://'
            - 'state=/'
            - 'state=//'
    filter_likely_false_positive:
        c-uri-query|contains: 'state=%7B'   # JSON-encoded or internal state format
    condition: selection and not filter_likely_false_positive
level: medium
falsepositives:
    - Legitimate state parameter values that happen to include a URL (e.g., if the application uses state to store a post-login redirect). Verify against application design.
    - Misconfigured OAuth integrations sending state as a full URL (unlikely in standard OAuth flows).
fields:
    - src_ip
    - c-uri-query
    - c-uri
tags:
    - attack.t1190
    - cve.2026.82274
    - cwe.601
    - oauth

YARA Rule

rule twenty_crm_oauth_open_redirect_cve_2026_82274 {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects web requests targeting the Twenty CRM OAuth callback with a state parameter set to a URL, indicating attempts to exploit CVE-2026-82274."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-82274"
        date = "2026-01-01"
        cve = "CVE-2026-82274"
        score = 60
    strings:
        $callback_path = /OAuthPropagatorController\.propagateOAuthCallback/i
        $state_http = /state\s*=\s*["']?http[s]?:\/\//i
        $state_double_slash = /state\s*=\s*["']?\/\//i
        $state_slash = /state\s*=\s*["']?\//i
    condition:
        $callback_path and ($state_http or $state_double_slash) and filesize < 10MB
}

Note: This rule is intended for analyzing web server access logs or PCAP-extracted HTTP headers. The $state_slash condition is intentionally omitted from the final and to reduce false positives from legitimate single-slash relative redirects.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"TwentyCRM OAuth Open Redirect Exploit Attempt (CVE-2026-82274)"; flow:to_server,established; content:"/OAuthPropagatorController/propagateOAuthCallback"; http_uri; nocase; content:"state="; http_uri; nocase; pcre:"/state\s*=\s*[^&\s]*(?:https?%3a%2f%2f|%2f%2f)/Ui"; classtype:attempted-recon; sid:44001234; rev:1; metadata:cve CVE-2026-82274, cwe CWE-601, mitre_tactic_id T1190;)

Explanation: The rule matches HTTP requests to the vulnerable callback path (/OAuthPropagatorController/propagateOAuthCallback) that contain a state parameter whose value includes http://, https:// (URL-encoded as %3a%2f%2f), or // (double-slash) — indicators of an absolute or protocol-relative URL. The PCRE regex handles both normal and URL-encoded characters. Adjust $HOME_NET to your network's internal range.

Elastic Detection

// EQL query targeting the vulnerable endpoint with anomalous state parameter
sequence by process.entity_id with maxspan=5m
  [ network where
      network.direction == "egress" and
      http.request.method == "GET" and
      url.path == "/OAuthPropagatorController/propagateOAuthCallback" and
      // Look for state parameter containing an external URL
      (url.query contains "state=http://" or url.query contains "state=https://" or url.query contains "state=//")
  ]
  [ http where
      status_code == 302 and
      location is not null and
      // The redirect location should NOT be the expected OAuth provider or internal host
      not startsWith(location, "https://accounts.google.com") and
      not startsWith(location, "https://github.com") and
      not startsWith(location, "http://localhost") and
      not startsWith(location, "/")
  ]

Note: Adjust the filter for expected OAuth providers based on your actual configuration.

Splunk SPL Query

index=web OR index=proxy
| search uri_path="/OAuthPropagatorController/propagateOAuthCallback" AND (uri_query="state=http://*" OR uri_query="state=https://*" OR uri_query="state=//*")
| eval isSuspicious=if(match(uri_query, "state\s*=\s*(https?%3a%2f%2f|%2f%2f|https?://)"), "TRUE", "FALSE")
| where isSuspicious=="TRUE"
| rex field=uri_query "state=(?<state_param>[^&]+)"
| rex field=uri_query "code=(?<oauth_code>[^&]+)"
| rex field=uri_query "scope=(?<oauth_scope>[^&]+)"
| table _time, src_ip, clientip, src_port, method, uri_path, state_param, oauth_code, oauth_scope, status
| eval oauth_code_present=if(isnull(oauth_code), "NO", "YES")
| stats count by src_ip, state_param, oauth_code_present

Explanation: This SPL query searches web/proxy logs for requests to the vulnerable endpoint that include a state parameter containing URL schemes. It extracts the state value and checks for the presence of an OAuth code parameter, which would indicate the authorization code is being transmitted to the attacker-controlled redirect target.

Wazuh OSSEC Rule

<group name="twenty_crm,">
  <rule id="100501" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*OAuthPropagatorController/propagateOAuthCallback</field>
    <regex>state=.*(https?://|//)</regex>
    <description>Twenty CRM Open Redirect attempt to OAuth callback endpoint with URL in state parameter (CVE-2026-82274)</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Note: This rule assumes the Wazuh agent is capturing web server logs (e.g., Apache/Nginx JSON logs) and the url and regex fields are populated. Adjust field names to match your log decoder configuration (e.g., web.url, http_uri).

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor advisory, fix version, or official workaround has been issued by Twenty at the time of this report. The following measures are recommended but should be verified against your environment.

1) Immediate Mitigations (compensating controls):

• Enable IS_MULTIWORKSPACE_ENABLED: If your deployment can tolerate multi-workspace mode, enabling this flag may activate the domain validation that blocks the open redirect. Test thoroughly in a staging environment, as this can change application behavior significantly.
• Deploy a WAF rule: Use a Web Application Firewall (ModSecurity, Cloudflare, AWS WAF, etc.) to block requests to /OAuthPropagatorController/propagateOAuthCallback where the state parameter value starts with http://, https://, or //. Example ModSecurity rule:

  SecRule REQUEST_URI "@contains /OAuthPropagatorController/propagateOAuthCallback" \
    "id:10001,phase:1,deny,t:lowercase,\
    msg:'TwentyCRM OAuth State Redirect Block (CVE-2026-82274)',\
    chain"
  SecRule ARGS:state "@rx ^(https?|//)" "t:urlDecode"
  

• Disable OAuth-based single sign-on temporarily: If OAuth is not business-critical, disable it until a patch is available, reverting to local credentials.
• Restrict network access to the Twenty CRM instance: If the application is internal-only, enforce network-level access control (firewall rules) to limit who can reach the OAuth callback endpoint.

2) Patch / Upgrade Steps:

• Monitor vendor communications: Subscribe to Twenty's GitHub releases and security announcements. Watch for a version > 2.35.0 that addresses this CVE.
• Apply the fix when available: Once a patched version is released, upgrade immediately. Test the upgrade in a staging environment, validating OAuth flows (both standard and error/login-failure paths).
• If you cannot upgrade immediately: Implement all immediate mitigations above and track the vendor's patch timeline.

3) Long-Term Hardening:

• OAuth implementation review: Audit the application's handling of the OAuth state parameter. A correct implementation should treat state as an opaque value used for CSRF/session correlation, never as a redirect destination. Any post-authentication redirects should be validated against an allowlist of trusted domains (or derived from the OAuth session, not from user-controlled input).
• Enable multi-workspace mode if practical: This configuration appears to add a security control; retaining it enabled provides defense-in-depth.
• Monitor OAuth tokens: Implement anomaly detection for authorization code usage (multiple exchanges, unusual geolocation).
• Security testing: Include this vulnerability class (CWE-601, OAuth state abuse) in your application security testing program (SAST, DAST, manual pen-testing).
• Logging and retention: Ensure the OAuth callback endpoint logs complete query strings (state, code) with sufficient retention to support forensic investigation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82274 — Official NVD record, including CVSS vector and CWE-601 classification.
2. Twenty CRM Official Repository: https://github.com/twentyhq/twenty — Monitor releases and issues for patch announcements. (Check for security advisory in the repo's Security tab.)
3. CWE-601 Open Redirect Reference: https://cwe.mitre.org/data/definitions/601.html — MITRE reference for the vulnerability class, including detection and mitigation techniques.
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Check periodically; this CVE is currently NOT listed (as of report date), but may be added if exploited in the wild.
5. OAuth 2.0 Security Best Current Practice (RFC 9700): https://www.rfc-editor.org/rfc/rfc9700.html — Reference for proper OAuth state parameter handling and redirect validation.

Threat Actor Activity: No threat actor campaigns or exploitation in the wild have been publicly attributed to CVE-2026-82274 as of this report. Given the unpatched status, the attack vector is attractive to opportunistic actors targeting exposed Twenty CRM instances. The lack of public PoC does not preclude exploitation; self-service exploitation is plausible for attackers familiar with OAuth flows.