Open Redirect in Twenty CMS OAuth Propagator

Executive Summary

This vulnerability is an open redirect issue in Twenty versions up to 2.35.0. It occurs in the OAuthPropagatorController.propagateOAuthCallback endpoint where the state query parameter is treated as a redirect URL. Attackers can manipulate this parameter to redirect users to malicious hosts while forwarding OAuth authorization codes, bypassing domain validation when IS_MULTIWORKSPACE_ENABLED is disabled.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to trick users into visiting malicious websites while appearing legitimate. Users might unknowingly share sensitive OAuth authorization codes with attackers, leading to potential account takeovers or unauthorized access to user data.

Useful 0 Not Useful 0

Mitigation Strategies

Update Twenty to version 2.35.1 or later to address the open redirect vulnerability. If using IS_MULTIWORKSPACE_ENABLED, ensure domain validation is enforced for OAuth callbacks. Review server logs for suspicious OAuth callback requests with arbitrary redirect URLs.

Useful 0 Not Useful 0