SigNoz up to 0.142.x Session Management reset UpdatePasswordByResetPasswordToken/DeleteUser password recovery

Summaryinfo

A vulnerability identified as critical has been detected in SigNoz up to 0.142.x. Impacted is the function UpdatePasswordByResetPasswordToken/DeleteUser of the file /api/v2/factor_password/reset of the component Session Management. The manipulation leads to password recovery. This vulnerability is documented as CVE-2026-97056. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in SigNoz up to 0.142.x and classified as critical. This issue affects the function UpdatePasswordByResetPasswordToken/DeleteUser of the file /api/v2/factor_password/reset of the component Session Management. The manipulation with an unknown input leads to a password recovery vulnerability. Using CWE to declare the problem leads to CWE-640. The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-97056 since 09/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 0.143.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• SigNoz

Version

• 0.142

Website

• Product: https://github.com/SigNoz/signoz/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion