VulnSocial

CVE-2026-63094Disclosure

LOWCVSS 7.6 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-345CWE-601

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-17: 1Technical Details · 2026-07-17: 107-17
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
Full discourse1 post
  • Xavier Rivera@XavierRiveraX
    Disclosure

    SigNoz through version 0.133.0 has an open redirect flaw in its SSO login flow, CVE-2026-63094, CVSS 8.1, no authentication required to exploit. The bug does not touch SigNoz's own login, it hijacks whatever Google OAuth, SAML, or OIDC provider sits behind it. https://thecircuitry.to/article/signoz-01330-open-redirect-lets-attackers-steal-sso-tokens-mrp3slcq

    Post summary

    The linked article discloses CVE-2026-63094, an open redirect flaw in SigNoz 0.133.0’s SSO flow that can be exploited without authentication to hijack OAuth/SAML/OIDC providers and steal tokens.

    00021144
    601 followersView on X

Explore more

Back to dashboard