SigNoz CVE-2026-63094

The target SigNoz instance (≤0.133.0) must be configured with an external SSO provider - specifically Google OAuth, SAML, or OIDC; instances using only local authentication are not exploitable. The attacker needs no credentials to generate the malicious login URL by supplying a crafted 'ref' parameter to the unauthenticated sessions-context endpoint. Exploitation is LIMITED by required victim interaction (UI:P / AT:P): a legitimate user must click the attacker-delivered login URL and complete the full SSO authentication flow for tokens to be exfiltrated - the attacker cannot obtain tokens passively without this victim action.

The vendor CVSS 4.0 score is 7.6 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N - network-reachable and unauthenticated (PR:N) but requiring both a present attack requirement (AT:P) and passive user interaction (UI:P), i.e. the victim must click the crafted link and complete SSO. This is a credible, real-world priority rather than a paper-high score: publicly available exploit code exists and it was reported by a reputable research vendor (VulnCheck), yielding high confidentiality and integrity impact (full session/account takeover). Tempering factors: it is NOT in CISA KEV (no confirmed active exploitation), no EPSS score was provided to gauge exploitation probability, and exploitation is conditional on an SSO deployment plus victim interaction, so it is not a mass-automatable, single-shot exploit. No conflicting signals were observed between the CVSS vector and the description - both agree on unauthenticated network access with required victim interaction. Do not conflate the available POC with active exploitation; these remain distinct signals here.

An attacker with no credentials calls the unauthenticated SigNoz sessions-context endpoint with a 'ref' parameter pointing to a host they control, producing a crafted SSO login URL, and sends it to a target SigNoz user via phishing. When the victim clicks it and completes their normal Google/SAML/OIDC login, their access and refresh tokens are redirected to the attacker's host, granting full account takeover. Publicly available exploit code exists, and the attack complexity is low once an SSO-enabled instance is identified.