---
cve: "CVE-2026-63094"
severity: "HIGH"
cvss: 7.6
epss: "0.3%"
vendor: "SigNoz"
kev: false
exploited: false
published: "2026-07-17 15:16:47"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:42:32+01:00"
---

# CVE-2026-63094

> 7.6 HIGH · 🧪 PoC

## Beschreibung

SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-07-27 17:17:11
- CNA-CVSS: **7.6** (`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-345** — Insufficient Verification of Data Authenticity
  The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
- **CWE-601** — URL Redirection to Untrusted Site
  The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

## Angriffsmuster (CAPEC)

- [CAPEC-111 — JSON Hijacking (aka JavaScript Hijacking)](https://capec.mitre.org/data/definitions/111.html) _(Severity: High)_
- [CAPEC-141 — Cache Poisoning](https://capec.mitre.org/data/definitions/141.html) _(Severity: High)_
- [CAPEC-142 — DNS Cache Poisoning](https://capec.mitre.org/data/definitions/142.html) _(Severity: High)_
- [CAPEC-148 — Content Spoofing](https://capec.mitre.org/data/definitions/148.html) _(Severity: Medium)_
- [CAPEC-218 — Spoofing of UDDI/ebXML Messages](https://capec.mitre.org/data/definitions/218.html) _(Severity: Medium)_
- [CAPEC-384 — Application API Message Manipulation via Man-in-the-Middle](https://capec.mitre.org/data/definitions/384.html) _(Severity: Low)_
- [CAPEC-385 — Transaction or Event Tampering via Application API Manipulation](https://capec.mitre.org/data/definitions/385.html) _(Severity: Medium)_
- [CAPEC-386 — Application API Navigation Remapping](https://capec.mitre.org/data/definitions/386.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1557.002 — Adversary-in-the-Middle: ARP Cache Poisoning](https://attack.mitre.org/techniques/T1557/002/)
- [T1584.002 — Compromise Infrastructure: DNS Server](https://attack.mitre.org/techniques/T1584/002/)
- [T1491 — Defacement](https://attack.mitre.org/techniques/T1491/)

## Patch verfügbar (OSV)

- 8c6a0de8c36e7982099437bfe2476c1a4ccbc553 (Commit)
- 253ca7dd7eb4f7a32a694c249eb0d5d0804d5619 (Commit)

## Referenzen

- <https://github.com/SigNoz/signoz/issues/11746>
- <https://github.com/SigNoz/signoz/releases/tag/v0.134.0>
- <https://github.com/SigNoz/signoz/pull/12172>
- <https://github.com/SigNoz/signoz/commit/253ca7dd7eb4f7a32a694c249eb0d5d0804d5619>
- <https://www.vulncheck.com/advisories/signoz-sso-oauth-state-manipulation-session-token-theft>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-63094/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_