CVE-2026-97055
Received Received - Intake

JWT Session Token Forgery in SigNoz

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description
SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() does not reject the empty value, so a deployment that does not configure a secret starts up and both signs and verifies session tokens with an empty HMAC key. Because the JWT tokenizer was the default provider, any such deployment is affected. An unauthenticated attacker who knows the ID of an existing user can forge a valid session token for that user — including an administrator — by signing the id, orgId and email claims with an empty key; the organization ID (and whether an email is registered) can be obtained without authentication from /api/v2/sessions/context. A forged refresh token can be exchanged at /api/v2/sessions/rotate for a new token pair and cannot be revoked, so it remains usable for its full lifetime (30 days by default). Fixed in v0.143.0, which requires a JWT secret when the jwt provider is selected and changes the default provider to opaque.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97055
EUVD
EUVD-2026-85774

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
signoz signoz From 0.8.0 (inc) to 0.143.0 (exc)
signoz signoz 0.143.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1188 The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SigNoz versions from v0.8.0 to v0.142.1. It involves the JWT tokenizer using an empty string as the default signing secret. This allows unauthenticated attackers to forge valid session tokens for any user, including administrators, by knowing their user ID and organization ID. Tokens are signed and verified with an empty HMAC key, enabling session token forgery.

Detection Guidance

Check if your SigNoz deployment is running a vulnerable version (v0.8.0 to v0.142.1) by inspecting the version tag or logs. Verify if the JWT tokenizer is enabled and if the JWT secret is empty by examining configuration files or environment variables like SIGNOZ_TOKENIZER_JWT_SECRET or SIGNOZ_JWT_SECRET.

Impact Analysis

An attacker can impersonate any user, including admins, gaining their permissions. Forged refresh tokens remain valid for 30 days and cannot be revoked without setting a secret. Attackers only need a user ID, obtainable from logs or endpoints like /api/v2/sessions/context. This leads to unauthorized access and potential data breaches.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and access control. It enables unauthorized access to sensitive data, which could result in breaches of GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations must address this to maintain regulatory compliance.

Mitigation Strategies
  • Upgrade SigNoz to v0.143.0 or later to enforce JWT secret requirements and switch the default tokenizer to opaque.
  • If upgrading is not immediately possible, set a strong JWT secret via SIGNOZ_TOKENIZER_JWT_SECRET or SIGNOZ_JWT_SECRET environment variables.
  • Rotate all existing session tokens and refresh tokens to invalidate potential forged tokens.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97055. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart