CVE-2026-63094: SigNoz Auth Bypass Vulnerability

CVE-2026-63094 Overview

CVE-2026-63094 is an open redirect vulnerability in SigNoz through version 0.133.0 that enables session token theft through the Single Sign-On (SSO) authentication flow. The flaw affects instances configured with Google OAuth, Security Assertion Markup Language (SAML), or OpenID Connect (OIDC). Unauthenticated attackers can call the sessions context endpoint with a ref parameter pointing to an attacker-controlled host. When a victim completes SSO authentication using the crafted login URL, their access and refresh tokens are delivered to the attacker. The weakness is categorized under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Attackers can steal SSO access and refresh tokens from any user on affected SigNoz instances, resulting in full account takeover across observability data.

Affected Products

SigNoz observability platform through version 0.133.0
SigNoz instances configured with Google OAuth SSO
SigNoz instances configured with SAML or OIDC identity providers

Discovery Timeline

2026-07-17 - CVE-2026-63094 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in the NVD database

Technical Details for CVE-2026-63094

Vulnerability Analysis

The vulnerability resides in the SigNoz sessions context endpoint, which is reachable without authentication. This endpoint accepts a ref parameter used to construct the SSO callback URL returned to the client. SigNoz does not validate that the supplied ref value belongs to a trusted origin. An attacker sets ref to a host they control and receives a fully signed SSO login URL from the server. The victim clicking that URL completes authentication with the legitimate identity provider, but the resulting access and refresh tokens are redirected to the attacker's endpoint.

Root Cause

SigNoz treated the client-supplied ref and callback state as trusted input when generating SSO login URLs. The global configuration in pkg/global/config.go had no notion of an origin allow-list, so origin validation could not occur during session creation in pkg/modules/session/implsession/module.go. This is a state-integrity failure aligned with [CWE-345].

Attack Vector

Exploitation is remote and requires user interaction. An attacker calls the unauthenticated sessions context endpoint with ref=https://attacker.tld, obtains a crafted SSO login URL, and delivers it to a victim through phishing or a link in a trusted channel. When the victim authenticates through Google OAuth, SAML, or OIDC, the SSO callback delivers the issued tokens to the attacker-controlled origin embedded in the state.

// Patch: pkg/global/config.go
// Introduces AllowedOrigins to constrain accepted ref/callback origins
var (
	ErrCodeInvalidGlobalConfig = errors.MustNewCode("invalid_global_config")
	ErrCodeOriginNotAllowed    = errors.MustNewCode("origin_not_allowed")
)

type Config struct {
	ExternalURL    *url.URL   `mapstructure:"external_url"`
	AllowedOrigins []*url.URL `mapstructure:"allowed_origins"`
	IngestionURL   *url.URL   `mapstructure:"ingestion_url"`
	MCPURL         *url.URL   `mapstructure:"mcp_url"`
	AIAssistantURL *url.URL   `mapstructure:"ai_assistant_url"`
}

Source: SigNoz commit 253ca7d

Detection Methods for CVE-2026-63094

Indicators of Compromise

Requests to the SigNoz sessions context endpoint containing a ref parameter that references an external or non-corporate host.
SSO callback redirects terminating at hostnames that do not match the configured external_url of the SigNoz deployment.
Successful token issuance events immediately followed by API access from previously unseen IP addresses or user agents.

Detection Strategies

Inspect SigNoz reverse proxy and application logs for anomalous values in the ref query parameter on the sessions context endpoint.
Correlate SSO login initiations with the destination origin of the resulting redirect to flag mismatches against the deployment domain.
Alert on refresh-token usage from geolocations, ASNs, or devices that diverge from the enrolled user's baseline.

Monitoring Recommendations

Forward SigNoz authentication and session logs to a Security Information and Event Management (SIEM) platform for continuous review.
Track token issuance rates per user and per origin to surface distribution-based anomalies.
Monitor identity provider audit logs for SSO assertions consumed by callback URLs outside the sanctioned SigNoz origins.

How to Mitigate CVE-2026-63094

Immediate Actions Required

Upgrade SigNoz to a version later than 0.133.0 that includes commit 253ca7d.
Rotate all active SigNoz access and refresh tokens and force user re-authentication after upgrade.
Review recent SSO logins for callbacks that terminated at unexpected origins and revoke suspicious sessions.

Patch Information

The upstream fix is delivered in SigNoz commit 253ca7dd7eb4f7a32a694c249eb0d5d0804d5619 and pull request #12172. The patch introduces an AllowedOrigins configuration in pkg/global/config.go and enforces validation of the ref and callback state in pkg/modules/session/implsession/module.go. See the VulnCheck advisory and issue #11746 for additional context.

Workarounds

Restrict access to the SigNoz sessions context endpoint at the reverse proxy or Web Application Firewall (WAF) layer until upgrade is complete.
Block or strip untrusted values of the ref parameter using WAF rules that enforce host allow-listing against the SigNoz external_url.
Temporarily disable Google OAuth, SAML, and OIDC providers on affected instances and require local authentication until the patch is applied.

bash

# Configure allowed_origins in the SigNoz global config after upgrade
global:
  external_url: "https://signoz.example.com"
  allowed_origins:
    - "https://signoz.example.com"
    - "https://sso.example.com"