CVE-2026-97056 Details
Description
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.
A vulnerability exists in SigNoz versions 0.98.0 prior to 0.143.0, when the opaque session tokenizer is used. The issue arises because the application does not revoke existing login sessions when a user's password is reset using a reset token or when a user is deleted. This oversight allows an attacker with a valid session token to maintain access to the account, including administrative privileges, until the token expires or is manually rotated. The vulnerability undermines the intended security measures of password resets and user deletions.
Upgrade to SigNoz version 0.143.0 or later, which addresses this vulnerability by revoking sessions on password resets and user deletions. If an immediate upgrade is not possible, users can manually delete sessions after a password reset or user deletion, or wait for the token rotation interval to expire.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/SigNoz/signoz/commit/b02aae2db3 | [email protected] | Source CodeVendor |
| https://github.com/SigNoz/signoz/commit/c122bc09b4 | [email protected] | Source CodeVendor |
| https://github.com/SigNoz/signoz/commit/e2e9173986 | [email protected] | Source CodeVendor |
| https://github.com/SigNoz/signoz/commit/faaed20dbd | [email protected] | Source CodeVendor |
| https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83 | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/signoz-before-0.143.0-insufficient-session-expiration-authentication-bypass | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-613 | Insufficient Session Expiration | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SigNoz | >= 0.98.0, < 0.143.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |