Threats affecting pkg:github/signoz

SigNoz versions before 0.134.0 have an open redirect vulnerability in the SSO authentication flow. This flaw allows unauthenticated attackers to craft login URLs that redirect victims to attacker-controlled sites, enabling theft of session tokens for users on instances configured with Google OAuth, SAML, or OIDC. The vulnerability is fixed in version 0.134.0.

CVE-2026-57956 is an authorization bypass vulnerability in SigNoz versions before 0.133.0. It allows authenticated users to access and manipulate alert rules belonging to other organizations by exploiting missing tenant isolation checks. This flaw enables reading, editing, and deleting alert rules across organizational boundaries, bypassing multi-tenant access controls.