# CVE-2026-97056: SigNoz session token revocation bypass on password reset and user deletion

Source: https://junglewise.ai/threats/cve-2026-97056-signoz-versions-from-v0-98-0-up-to-but-not-including-v0-143-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-97056 · Severity: medium · CVSS 6.8 · Published 2026-09-24

SigNoz is an open-source observability platform that manages user sessions and authentication. When using the opaque session tokenizer (the default from v0.143.0 onwards), the system fails to revoke existing login sessions when a user's password is reset or their account is deleted. An attacker with a stolen session token can retain full account access—including administrator privileges—for up to 30 days after a password reset or 30 minutes after user deletion, defeating these common security controls.

Technologies: [Signoz](https://junglewise.ai/threats/technologies/signoz). Vendors: [SigNoz](https://junglewise.ai/threats/vendors/signoz).

## Quick answers

**Is CVE-2026-97056 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97056 being exploited in the wild.

**How severe is CVE-2026-97056?** Medium severity, with a CVSS score of 6.8, published 24 September 2026.

**Which products and versions are affected?** Signoz v0.98.0 to v0.142.x.

**Is there a fix for CVE-2026-97056?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97056 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97056?** Check whether you run Signoz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the password reset (UpdatePasswordByResetPasswordToken via POST /api/v2/factor_password/reset) and user deletion (DeleteUser via DELETE /api/v2/users/{id}) code paths, which fail to call the tokenizer's DeleteTokensByUserID function when using the opaque session tokenizer. This leaves cached tokens and session identities in place, allowing token reuse even after access should be revoked. The issue only affects deployments explicitly configured to use the opaque tokenizer and is fixed in v0.143.0.

## Affected products

- SigNoz SigNoz v0.98.0 to v0.142.x

## Timeline

- 2026-09-24: disclosed

## References

- [https://github.com/SigNoz/signoz/commit/b02aae2db3](https://github.com/SigNoz/signoz/commit/b02aae2db3)
- [https://github.com/SigNoz/signoz/commit/c122bc09b4](https://github.com/SigNoz/signoz/commit/c122bc09b4)

## Related threats

- [SigNoz JWT tokenizer authentication bypass via empty signing secret](https://junglewise.ai/threats/cve-2026-97055-signoz-from-v0-8-0-before-v0-143-0-defaults-the-jwt-tokenizer)
- [SigNoz SQL injection in query_range API field-key names](https://junglewise.ai/threats/cve-2026-93426-signoz-sql-injection-in-query-range-api-field-key-names)
- [SigNoz SQL injection in trace-funnel analytics](https://junglewise.ai/threats/cve-2026-93292-signoz-sql-injection-in-trace-funnel-analytics)
- [SigNoz authorization bypass in trace-funnel analytics endpoints](https://junglewise.ai/threats/cve-2026-92729-signoz-authorization-bypass-in-trace-funnel-analytics-endpoints)
- [SigNoz open redirect and session token theft in SSO flow](https://junglewise.ai/threats/cve-2026-63094-signoz-open-redirect-and-session-token-theft-in-sso-flow)