Read the docs
TI-2026-45044 Aliases CVE-2026-63094GHSA-xmw5-w4c2-cp2g

SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft

Priority HIGH 68CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass, Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345 and CWE-601.

Summary

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed signoz (SigNoz): 0.134.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SigNozsignozbefore 0.134.00.134.0Patch availableCNA
  • signoz VendorSigNoz Affected before 0.134.0 Fixed in 0.134.0 Patch available CNA

Remediation

  • Fix · CNA signoz (SigNoz) Fixed in 0.134.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63094
  2. 2026-10-03 Alias added: GHSA-xmw5-w4c2-cp2g

References

Exploit 1

Patch 2

Other 1

  • TI-2026-62489 SigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints CVSS 4.0HIGH 8.8
  • TI-2026-63930 SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret CVSS 4.0CRITICAL 9.2
  • TI-2026-62973 SigNoz 0.87.0 before 0.142.0 - SQL Injection in v5 Query Builder Field Key Names CVSS 4.0HIGH 8.4
  • TI-2026-62911 SigNoz 0.88.0 before 0.142.1 - SQL Injection in Trace Funnel Analytics Query Builders CVSS 4.0HIGH 8.4
  • TI-2026-63931 SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass CVSS 4.0HIGH 7.6
  • TI-2026-41722 SigNoz < 0.133.0 - Cross-Organization Insecure Direct Object Reference in Alert Rules CVSS 4.0MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences