CVE-2026-63094
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An open redirect vulnerability in SigNoz before 0.134.0 in the SSO authentication flow. An unauthenticated attacker can steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC.
Risk Assessment
An attacker can capture user access and refresh tokens, allowing account takeover and access to sensitive data.
Recommendation
Update SigNoz to version 0.134.0 or later, which contains the fix.
Other vulnerabilities in SigNoz
See all- CVE-2026-57956Medium
A vulnerability in SigNoz before version 0.133.0 allows authenticated users to access alert rules of other organizations by supplying a target rule UUID. The alert rule store lacks filtering by organization ID, bypassing multi-tenant access controls.
- CVE-2026-57955High
A SQL injection vulnerability in SigNoz through version 0.130.1 allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of alert-history endpoints. Attackers can read all stored traces, logs, and metrics or abuse the url() function for server-side request forgery (SSRF).
Original NVD description (English source)
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.