In SigNoz versions >=0.98.0 and <0.143.0, when the opaque session tokenizer is enabled (not the default before 0.143.0), the system fails to call DeleteTokensByUserID during password reset or user deletion. Consequently, cached session tokens remain valid, allowing an attacker who already holds a session token to maintain full access to the account, including administrative privileges, after a password reset or user deletion. The default maximum token lifetime is 30 days for password reset and 30 minutes for user deletion token rotation. This vulnerability undermines the effectiveness of password reset and user deletion as methods to terminate access. The flaw is addressed in SigNoz version 0.143.0.

An attacker with an existing session token can retain full access to a user's account, including administrative rights, even after the user resets their password or is deleted. This persistence of access lasts until the session token expires or rotates, which can be up to 30 days for password resets and 30 minutes for user deletions. This compromises account security by defeating standard access termination mechanisms.

Upgrade to SigNoz version 0.143.0 or later, where this issue is fixed. Prior to upgrading, be aware that password resets and user deletions do not revoke existing session tokens when using the opaque session tokenizer. No other mitigation is indicated by the vendor advisory.