SigNoz through 0.133.0 is affected by a reported open redirect in the SSO flow (referenced in NVD as CVE-2026-63094) that lets unauthenticated attackers steal access and refresh tokens from users on Google OAuth, SAML, or OIDC instances. The CVSS 3.1 score of 8.1 from VulnCheck marks it high severity and requires immediate patching on affected self-hosted deployments.
Corrected SigNoz fix PR reference from #11844 to the merged #12172 (NVD later replaced the superseded PR link).
The flaw enables session token theft on configured instances.
When the victim completes SSO authentication, the attacker receives the victim's access and refresh tokens.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CISA added AhsayCBS flaws CVE-2026-105134 and CVE-2026-105133 to its Known Exploited Vulnerabilities catalog on October 14, with an October 17 deadline for federal agencies. Attackers are chaining them to plant webshells and cryptominers, and Ahsay says its first patches did not fully fix them.
bbs-go through 4.4.6 has a Google One Tap login flaw (CVE-2026-111639) that skips ID-token audience checks, letting attackers replay tokens from any OAuth client to take over Google-linked accounts. VulnCheck rates it 8.1 (CVSS 3.1) and 8.6 (CVSS 4.0).
FreeRDP versions 3.29.0 before 3.32.0 contain an integer overflow in the Apple audin backends (CVE-2026-111380) that leads to a heap out-of-bounds write. VulnCheck as the CNA rates the flaw 8.8 under CVSS 3.1 and 8.7 under CVSS 4.0.
Lenovo disclosed CVE-2026-92629, a high-severity improper authorization flaw in Baiying PC Client versions before 1.1.0.295 that could allow local authenticated users to execute arbitrary code with elevated privileges. Lenovo PSIRT as the CNA rates the issue 7.3 under CVSS 3.1 and 7.0 under CVSS 4.0.
Lenovo has fixed CVE-2026-75941 in the Legion Zone application before version 2.0.28.8182. Lenovo PSIRT as CNA rates the flaw 8.0 under CVSS 3.1 and 8.6 under CVSS 4.0, allowing same-network arbitrary code execution in the China-only app.
