SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker‑controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication. The flaw permits capturing session tokens without any credentials from the attacker. This vulnerability is classified as CWE‑345 (Open Redirection) and CWE‑601 (Untrusted Redirect).

The vulnerability affects configurations of SigNoz instances that use third‑party SSO providers such as Google OAuth, SAML, or OIDC. No specific version information is provided in the advisory, but the flaw exists in the publicly exposed sessions context endpoint that accepts the ref parameter.

The CVSS score of 7.6 reflects a moderate‑to‑severe risk profile, but the EPSS score of <1% indicates a low likelihood of observed exploitation. The vulnerability is not yet listed in CISA KEV. An attacker can trigger the redirect without authentication but must influence a legitimate user to complete the SSO flow, so the attack vector is unauthenticated initial access with user interaction. Once the victim authenticates, the attacker receives both the access and refresh tokens, enabling full impersonation of that user.