CVE-2026-82274

Name of the Vulnerable Software and Affected Versions Twenty versions prior to 2.35.0

Description An open redirect issue exists in the OAuthPropagatorController.propagateOAuthCallback endpoint. The system incorrectly treats the state query parameter as a redirect URL. When the IS MULTIWORKSPACE ENABLED variable is disabled, domain validation is bypassed, allowing attackers to craft requests that redirect users to arbitrary hosts while forwarding OAuth authorization codes.

Recommendations Update to version 2.35.0 or later. As a temporary mitigation, ensure the IS MULTIWORKSPACE ENABLED variable is enabled to maintain domain validation.