CVE-2026-63094CWE-345CWE-601

SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

High · published July 17, 2026

CVSS v4.0
7.6
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

The record
Technical detail
CVSS v4.0
7.6 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00262 · 17.0th percentile
Weaknesses
CWE-345 · Insufficient Verification of Data Authenticity; CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-07-17T14:22Z
EPSS history
Timeline
  • 17 JUL 14:22Z
    SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
    cvelistv5