CVE-2026-97056
Received Received - Intake

Session Token Persistence in SigNoz After Password Reset or User Deletion

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: VulnCheck

Description
SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-97056
EUVD
EUVD-2026-85773

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
signoz signoz to 0.143.0 (exc)
signoz signoz 0.143.0
signoz signoz From 0.98.0 (inc) to 0.143.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-613 According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SigNoz versions from v0.98.0 to v0.142.0 when using the opaque session tokenizer. When a user resets their password or their account is deleted, existing login sessions are not revoked. Attackers with a stolen session token can retain full account access until the token expires, which defaults to 30 days for password resets and 30 minutes for user deletions.

Detection Guidance

To detect this vulnerability, check SigNoz versions between v0.98.0 and v0.142.0 using opaque session tokenizer. Verify if password resets or user deletions fail to revoke active sessions. Inspect auth_token table for stale sessions after such actions. Use commands like 'kubectl get pods -n signoz' to check versions and 'docker exec -it <container> psql -U postgres -d signoz -c "SELECT * FROM auth_token WHERE user_id = <id>;"' to review tokens.

Impact Analysis

If you use SigNoz in the affected versions, an attacker who gains access to a valid session token can maintain unauthorized access even after you reset your password or delete the user account. This could lead to data breaches, unauthorized actions, or persistent control over your SigNoz instance.

Compliance Impact

This vulnerability may violate compliance requirements that mandate timely revocation of access after password resets or user deletions, such as GDPR's data protection principles or HIPAA's access control rules. Failure to revoke sessions could result in unauthorized access persisting, leading to potential regulatory penalties.

Mitigation Strategies
  • Upgrade SigNoz to version 0.143.0 or later to ensure sessions are revoked during password resets and user deletions.
  • If upgrading is not immediately possible, restart SigNoz after user deletions to clear the session cache.
  • For deployments using the opaque session tokenizer, ensure users change their passwords again after a reset to invalidate any remaining sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97056. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart