What is CVE-2026-63094?

CVE-2026-63094 is a high-severity vulnerability in Signoz, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.1/10. Published 2026-07-17.

How severe is CVE-2026-63094?

High severity. CVSS v3 base score is 8.1 out of 10.

Open Redirect in Signoz

CVE-2026-63094

SigNoz through 0.133.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers c…

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N.

Affected products

Signoz — versions 0

Weakness classification (CWE)

CWE-345 — Insufficient Verification of Data Authenticity
CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

References

disclosure@vulncheck.com (technical-description, exploit)
disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-63094?: CVE-2026-63094 is a high-severity vulnerability in Signoz, classified under Insufficient Verification of Data Authenticity. CVSS score: 8.1/10. Published 2026-07-17.
How severe is CVE-2026-63094?: High severity. CVSS v3 base score is 8.1 out of 10.