Vulnerability-Lookup

GHSA-R949-5536-P6GG

Vulnerability from github – Published: 2026-09-24 03:30 – Updated: 2026-09-24 03:30

Details

SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the user's password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer's DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account — for example from a stolen browser session or from a user being offboarded — retains the account's full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

7.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-97056"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-613"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-24T02:16:54Z",
    "severity": "HIGH"
  },
  "details": "SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user\u0027s existing login sessions when the user\u0027s password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer\u0027s DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account \u2014 for example from a stolen browser session or from a user being offboarded \u2014 retains the account\u0027s full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0.",
  "id": "GHSA-r949-5536-p6gg",
  "modified": "2026-09-24T03:30:27Z",
  "published": "2026-09-24T03:30:27Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97056"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SigNoz/signoz/commit/b02aae2db3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SigNoz/signoz/commit/c122bc09b4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SigNoz/signoz/commit/e2e9173986"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SigNoz/signoz/commit/faaed20dbd"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/signoz-before-0.143.0-insufficient-session-expiration-authentication-bypass"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-97056 (GCVE-0-2026-97056)

Vulnerability from cvelistv5 – Published: 2026-09-24 01:53 – Updated: 2026-09-24 12:56

Title

SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

Summary

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 12:55 UTC

CWE

CWE-613 - Insufficient Session Expiration

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/SigNoz/signoz/security/advisor…	vendor-advisory
https://github.com/SigNoz/signoz/commit/faaed20dbd	patch
https://github.com/SigNoz/signoz/commit/e2e9173986	patch
https://github.com/SigNoz/signoz/commit/b02aae2db3	patch
https://github.com/SigNoz/signoz/commit/c122bc09b4	patch
https://www.vulncheck.com/advisories/signoz-befor…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
SigNoz	signoz	Affected: 0.98.0 , < 0.143.0 (semver) Unaffected: 0.143.0 (semver)

Date Public

2026-09-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97056",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T12:55:59.241523Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T12:56:55.730Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/SigNoz/signoz",
          "product": "signoz",
          "vendor": "SigNoz",
          "versions": [
            {
              "lessThan": "0.143.0",
              "status": "affected",
              "version": "0.98.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.143.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "datePublic": "2026-09-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user\u0027s existing login sessions when the user\u0027s password is reset with a reset token (UpdatePasswordByResetPasswordToken, reachable via POST /api/v2/factor_password/reset) or when the user is deleted (DeleteUser, reachable via DELETE /api/v2/users/{id}). Neither code path calls the tokenizer\u0027s DeleteTokensByUserID, so cached tokens and identities are left in place. An attacker who already holds a session token for the account \u2014 for example from a stolen browser session or from a user being offboarded \u2014 retains the account\u0027s full access, up to administrator, after a password reset until the token reaches its configured maximum lifetime (30 days by default), and after user deletion until the token next rotates (30 minutes by default). This defeats password reset and user deletion as a means of terminating access. The issue is fixed in v0.143.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T01:53:04.486Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-xrgp-3fq4-xg83)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/SigNoz/signoz/security/advisories/GHSA-xrgp-3fq4-xg83"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/SigNoz/signoz/commit/faaed20dbd"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/SigNoz/signoz/commit/e2e9173986"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/SigNoz/signoz/commit/b02aae2db3"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/SigNoz/signoz/commit/c122bc09b4"
        },
        {
          "name": "VulnCheck Advisory: SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/signoz-before-0.143.0-insufficient-session-expiration-authentication-bypass"
        }
      ],
      "title": "SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-97056",
    "datePublished": "2026-09-24T01:53:04.486Z",
    "dateReserved": "2026-09-23T23:51:32.670Z",
    "dateUpdated": "2026-09-24T12:56:55.730Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-R949-5536-P6GG

CVE-2026-97056 (GCVE-0-2026-97056)

Tags

Sightings

Nomenclature

Related by attack behaviour