CVE-2026-63094

SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

State: Published
Severity: 7.6 High
Published: Jul 17, 2026
Updated: Jul 27, 2026
Reserved: Jul 15, 2026

Description

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

Scores

CVSS	Score	Vector	Source
4.0	7.6 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
signozSigNoz	before 0.134.0Affected

References

Researcher Disclosuretechnical-descriptionexploit
Release Notesrelease-notes
Pull Requestissue-tracking
Patch Commitpatch
https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theftthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.