SigNoz 0.133.0 Open Redirect Lets Attackers Steal SSO Tokens

SigNoz through 0.133.0 is affected by a reported open redirect in the SSO flow (referenced in NVD as CVE-2026-63094) that lets unauthenticated attackers steal access and refresh tokens from users on Google OAuth, SAML, or OIDC instances. The CVSS 3.1 score of 8.1 from VulnCheck marks it high severity and requires immediate patching on affected self-hosted deployments.

Source:NVD

Post

SigNoz 0.133.0 Open Redirect Lets Attackers Steal SSO Tokens

TL;DRAI · 60 sec read

SigNoz through version 0.133.0 contains a high-severity open redirect vulnerability in its SSO authentication flow.

The flaw enables session token theft on configured instances. Unauthenticated attackers can exploit the vulnerability on deployments using Google OAuth, SAML, or OIDC. They call the unauthenticated sessions context endpoint with a ref parameter that points to an attacker-controlled host.

The flaw enables session token theft on configured instances.

The crafted login URL is then delivered to a victim. When the victim completes SSO authentication, the attacker receives the victim's access and refresh tokens.

CVSS scores rate the issue as high severity. The CVSS 3.1 base score stands at 8.1 with vector string AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. A separate CVSS 4.0 assessment from VulnCheck lists a base score of 7.6.

From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

The vulnerability falls under CWE-601 for URL Redirection to Untrusted Site and CWE-345 for Insufficient Verification of Data Authenticity. Both classifications come from VulnCheck.

When the victim completes SSO authentication, the attacker receives the victim's access and refresh tokens.

Fixes and disclosure references are now public. The issue was published to the CVE List on July 17, 2026. Related links include a GitHub issue at https://github.com/SigNoz/signoz/issues/11746, a pull request at https://github.com/SigNoz/signoz/pull/11844, and a VulnCheck advisory at https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theft.

Affected versions run from 0.0 through 0.133.0 according to the semver range listed in the CVE record. The record notes that this CVE was received from VulnCheck on July 17, 2026 at 11:16:47 AM. No NVD-provided CVSS 4.0 vector is available yet.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported

DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee

vulnerability security sso

MORE IN TECH

NASA and SpaceX Prepare for Nancy Grace Roman Space Telescope Launch

NASA and SpaceX are targeting a 7:26 AM EDT Sunday liftoff of a Falcon Heavy from Kennedy Space Center carrying the Nancy Grace Roman Space Telescope. The observatory will travel to Sun-Earth L2, where its Wide Field and Coronagraph instruments will search for exoplanets and study dark energy.

Carhartt data breach exposes 12.9 million accounts

ShinyHunters published data from 12.9 million genuine Carhartt accounts after the apparel company refused a $3.3 million ransom. The breach, which also exposed records for more than 15,000 employees, originated from Carhartt's Databricks analytics platform.

Nvidia Agrees to Acquire Hugging Face for $12.9 Billion

Nvidia has agreed to acquire open-source AI platform Hugging Face for $12.9 billion according to The Information. The deal would expand Nvidia's reach into the software and model ecosystem while highlighting its bet on continued AI demand growth.