Vulnerability · Published Jul 17, 2026 · Assigned by VulnCheck

CVE-2026-63094SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

High 8.1

In plain English

A high-severity open redirect in signoz from SigNoz. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 81.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

Affected products (as reported)

Vendor	Product	Versions
SigNoz	signoz	0 – before 0.134.0

Weakness: CWE-601, CWE-345 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

Researcher Disclosure technical-description, exploit
Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theft third-party-advisory