Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L P N P H H N 7.6 .0017 6.9 —
AFFECTED Product Versions Fixed signoz unspecified —
TIMELINE Jul 15 Reserved by VulnCheck Jul 17 EXPLOIT PUBLISHED — CVE-2026-63094 (signoz). Public exploit reference added. Jul 17 Published (CNA: VulnCheck)
SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication.
| Date | Event | Detail |
|---|---|---|
| July 15, 2026 | Reserved | Reserved by VulnCheck |
| July 17, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-63094 (signoz). Public exploit reference added. |
| July 17, 2026 | Published | Published (CNA: VulnCheck) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| SigNoz | signoz | — | — | — |
Authoritative record: CVE-2026-63094 at cve.org
Vendors: signoz
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-63094 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.