Could/Should I cite a paper that I am refereeing?
Reviewers obligations in general include respecting the confidentiality of peer review and not revealing any details of a manuscript or related communications, during or after the peer review process. Detailed for example in the COPE Ethical Guidelines for Peer Reviewers.

That said, by citing a confidential manuscript you reveal the title, potentially giving away a scientific message, and the authors, disclosing the fact they are working on a specific research question.

You can however cite a different version of the work in case it was previously published on a preprint server for example.