CVE-2026-63094
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
- CVSS 4.0
- 7.6 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-345, CWE-601
- Source
- disclosure@vulncheck.com
References
- https://github.com/SigNoz/signoz/commit/253ca7dd7eb4f7a32a694c249eb0d5d0804d5619
- https://github.com/SigNoz/signoz/issues/11746
- https://github.com/SigNoz/signoz/pull/12172
- https://github.com/SigNoz/signoz/releases/tag/v0.134.0
- https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theft
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.