CVE-2026-97056: SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factorpassword/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SigNozto a version that resolves this vulnerability.Fixed in 0.143.0
Event History
Frequently Asked Questions
Which deployments are affected?
Affected deployments run SigNoz v0.98.0 through versions before v0.143.0 and are configured to use the opaque session tokenizer. That tokenizer was not the default configuration before v0.143.0.
What must an attacker have to retain access?
The attacker must already possess a valid session token for the target account, such as one obtained from a stolen browser session. The retained access has the account's existing privileges, including administrator privileges where applicable.
How long can access persist after password reset or user deletion?
After a password reset, an existing session can remain valid until its configured maximum lifetime, which defaults to 30 days. After user deletion, it can remain valid until the token next rotates, which defaults to 30 minutes.
What version fixes the issue?
The issue is fixed in SigNoz v0.143.0.