CVE-2026-63094 Details
Description
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
A vulnerability allowing open redirection has been identified in SigNoz versions through 0.133.0, specifically within the Single Sign-On (SSO) authentication process. This issue enables unauthenticated attackers to steal session tokens from users on instances using Google OAuth, SAML, or OpenID Connect (OIDC). The vulnerability arises because the 'ref' parameter in the unauthenticated 'GET /api/v2/sessions/context' endpoint is not properly validated before being embedded into the OAuth state. Attackers can exploit this by directing victims to a crafted login URL that, once authenticated, returns the victims' access and refresh tokens to the attacker.
The vulnerability can be addressed by validating the 'ref' parameter against an allowlist of permitted redirect origins and signing the OAuth state with an HMAC secret to prevent forgery.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 17, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SigNoz | <= 0.133.0 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | CVE Modified | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |