CVE-2026-97056 - SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass
Brief
CVE ID : CVE-2026-97056
Published : Sept. 24, 2026, 2:16 a. m.
- 42 minutes ago
Description : SigNoz versions from v0.
- 0 up to (but not including) v0.
- 0, when configured to use the opaque session tokenizer (which was not the default before v0.
- 0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place.