Twenty exposes an open redirect through its OAuthPropagatorController.propagateOAuthCallback endpoint by treating the 'state' query parameter as a redirect URL. An attacker can construct a malicious callback request that includes an arbitrary URL in the state parameter, causing the application to redirect unsuspecting users to the attacker’s host while still forwarding OAuth authorization codes. This flaw allows phishing attacks, credential theft, or credential harvesting by redirecting users to malicious sites, thereby undermining the confidentiality of the user’s session and the integrity of the authentication flow. The weakness is a classic open‑redirect flaw identified as CWE‑601.

Vendors affected are twentyhq for the Twenty suite. Versions up to and including 2.35.0 contain the vulnerability. The issue arises in the core auth module (oauth-propagator.controller.ts). Systems running Twenty before patching to 2.36.0 or later are susceptible if the multi‑workspace feature is disabled. No explicit operating system or environment constraints are indicated; the flaw exists wherever the OAuth callback endpoint is exposed.

The CVSS base score of 5.3 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue, suggesting no widespread exploitation has been observed. The likely attack vector is an attacker sending a crafted HTTP request to the propagateOAuthCallback endpoint, which requires no authentication. Anyone who can trigger the OAuth flow—either through a malicious client or by inviting a victim to an OAuth authorization request—can exploit the flaw. Mitigation requires disabling the vulnerable pattern, enforcing strict redirect validation, or upgrading to a fixed release.