EUVD-2026-45177
GHSA-xmw5-w4c2-cp2g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attacker (PR:N) but exploitation needs the victim to click the crafted link and complete SSO (UI:R, AC:H); stolen tokens yield high confidentiality and integrity impact, no availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
AnalysisAI
Session token theft in SigNoz through 0.133.0 lets unauthenticated attackers hijack any user account on instances configured with Google OAuth, SAML, or OIDC single sign-on. Because the unauthenticated sessions-context endpoint accepts an attacker-controlled 'ref' parameter that is embedded unvalidated into the SSO state/redirect, an attacker crafts a login URL that returns the victim's access and refresh tokens to an attacker-controlled host once the victim completes SSO. Reported by VulnCheck (CWE-601, open redirect), publicly available exploit code exists, though it is not listed in CISA KEV and EPSS was not provided.
Technical ContextAI
SigNoz is an open-source observability/APM platform (a self-hosted Datadog/Grafana alternative) that supports enterprise SSO via OAuth2, SAML, and OIDC. The flaw is a CWE-601 open redirect rooted in how the SSO login flow builds its state/RelayState value: the GetSessionContext handler parsed the client-supplied 'ref' query parameter directly into the siteURL used to construct the login/callback redirect, with no origin allowlisting and no integrity protection on the OAuth 'state'. The PR #11844 fix confirms two root causes - (1) the OAuth state was unsigned (NewState), allowing manipulation, now replaced by an HMAC-signed state via NewStateWithSignature/NewStateFromStringWithVerification keyed on a new oauth_state_secret; and (2) the redirect target was unvalidated, now gated by a validateRedirectURL check against a configured allowed_redirect_origins list (which fails closed when unset). The affected code spans the Google (pkg/authn/callbackauthn/googlecallbackauthn), OIDC and SAML (ee/authn/callbackauthn) callback handlers, confirming all three SSO modes share the vulnerable pattern.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/SigNoz/signoz/pull/11844 by upgrading to the first tagged release above 0.133.0 that includes it (verify against SigNoz release notes, as no exact fixed version was provided in the input). The patch requires operators to set the new oauth_state_secret (enabling HMAC-signed OAuth state to block state manipulation) and to populate allowed_redirect_origins, since validateRedirectURL fails closed and rejects redirects when no origins are configured - so after upgrading you must explicitly list your legitimate SigNoz origin(s) or SSO login will be blocked. Until you can upgrade, the most effective compensating control is to temporarily disable SSO (Google/SAML/OIDC) and fall back to local authentication, which fully removes the attack surface at the cost of losing IdP-based login; alternatively, front SigNoz with a reverse proxy or WAF rule that rejects requests to the sessions-context endpoint whose 'ref' parameter points to any host outside your own domain, accepting that maintaining such an allowlist is error-prone. Corroborate details via the VulnCheck advisory at https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theft.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today