CVE-2026-63094
Last modified
CVE-2026-63094 is a high-severity vulnerability rated 8.1/10 on the CVSS scale. SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| SigNoz | signoz | <= 0.133.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-63094?
How severe is CVE-2026-63094?
How do I fix CVE-2026-63094?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-63089WireGuard Easy through 15.3.0, fixed in commit 66b292b, cont…9.3
- CVE-2026-6309Use after free in Viz in Google Chrome prior to 147.0.7727.1…8.3
- CVE-2026-63090ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based bu…8.8
- CVE-2026-63091ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed intege…7.1
- CVE-2026-63092kirby-modules through 5.5.7, fixed in commit 315417e, contai…5.3
- CVE-2026-63093Cursor for Windows version 3.2.16 contains a binary planting…8.8
- CVE-2026-63095Dendrite through 0.13.8 contains an improper authorization v…7.1
- CVE-2026-63096Dendrite through 0.13.8 contains a server-side request forge…6.9
- CVE-2026-63097Dendrite through 0.13.8 contains an improper access control …5.3
- CVE-2026-63098TheHive through 4.1.24 contains an unauthenticated informati…6.9
- CVE-2026-63099TheHive through 4.1.24 contains a broken object-level author…7.1
- CVE-2026-6310Use after free in Dawn in Google Chrome prior to 147.0.7727.…8.3
Are you affected by CVE-2026-63094?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST