Skip to content
Threat Feed
Subscribe

Vendor

SigNoz

2 briefs RSS
high advisory

Authorization Bypass in SigNoz Trace-Funnel Analytics

SigNoz versions 0.88.0 through 0.141.0 contain an authorization bypass vulnerability allowing unauthenticated remote attackers to query sensitive trace analytics via the trace-funnel endpoint.

SigNoz +3 authorization-bypass api-security observability sql-injection vulnerability web-application webserver injection +2
3r 3t 1c updated
high advisory

SigNoz Open Redirect Vulnerability Allows Session Token Theft (CVE-2026-63094)

An open redirect vulnerability exists in SigNoz through version 0.133.0 within its SSO authentication flow, affecting instances configured with Google OAuth, SAML, or OIDC. Unauthenticated attackers can exploit this by crafting a login URL with a malicious `ref` parameter pointing to an attacker-controlled host. By delivering this crafted URL to a victim, attackers can steal the victim's access and refresh tokens upon successful SSO authentication, leading to session compromise.

SigNoz <= 0.133.0 open-redirect sso vulnerability web-application credential-theft
3t 1c