CyberRota Analysis
AI-GeneratedAn open redirect vulnerability exists in the OAuthPropagatorController.propagateOAuthCallback endpoint of Twenty versions up to 2.35.0, allowing attackers to manipulate the state query parameter to redirect users to arbitrary URLs. This can lead to unauthorized access as OAuth authorization codes may be forwarded without proper domain validation, particularly when IS_MULTIWORKSPACE_ENABLED is disabled. Organizations utilizing this software should prioritize patching to mitigate the risk of phishing attacks and unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Twenty through 2.35.0 contains an open redirect vulnerability in the OAuthPropagatorController.propagateOAuthCallback endpoint that treats the state query parameter as a redirect URL. Attackers can craft malicious requests to redirect users to arbitrary hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.