CVE-2026-97056

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-97056

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97056.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-97056

Aliases

GHSA-xrgp-3fq4-xg83

Published

2026-09-24T01:53:04Z

Modified

2026-09-26T03:30:28Z

Severity

7.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

Details

SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-613"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97056.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "0.98.0"
                },
                {
                    "fixed":  "0.143.0"
                }
            ],
            "source":  "AFFECTED_FIELD"
        },
        {
            "extracted_events":  [
                {
                    "fixed":  "v0.143.0"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/signoz/signoz

Affected ranges

Type

GIT

Repo

https://github.com/signoz/signoz

Events

Introduced

Fixed

b02aae2db3

Fixed

c122bc09b4

Fixed

e2e9173986

Fixed

faaed20dbd

Database specific

Show details

{
    "source":  "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97056.json"