---
id: CVE-2026-63094
title: SigNoz < 0.134.0 SSO OAuth State Manipulation Session Token Theft
summary: >-
  SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO
  authentication flow that allows unauthenticated attackers to steal session
  tokens from any user on instances configured with Google OAuth, SAML, or OIDC.
  Attackers …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-601
  - CWE-345
vendor: SigNoz
product: signoz
affected:
  - signoz < 0.134.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-21T01:38:52.091051Z'
exploitAvailable: true
published: '2026-07-17'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:38.946Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63094'
references:
  - url: 'https://github.com/SigNoz/signoz/issues/11746'
    label: Researcher Disclosure
  - url: 'https://github.com/SigNoz/signoz/releases/tag/v0.134.0'
    label: signoz 0.134.0 Release Notes
  - url: 'https://github.com/SigNoz/signoz/pull/12172'
    label: Pull Request
  - url: >-
      https://github.com/SigNoz/signoz/commit/253ca7dd7eb4f7a32a694c249eb0d5d0804d5619
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theft
tags:
  - cve.org
  - exploit-available
epss: 0.00262
epssPercentile: 0.18088
ingestedAt: '2026-11-08T14:51:22.273Z'
---

## Overview

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

## Affected

- `signoz < 0.134.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.