Threats affecting pkg:github/signoz/signoz

SigNoz versions from 0.8.0 up to but not including 0.143.0 have a vulnerability where the JWT tokenizer signing secret defaults to an empty string if not configured. This allows an unauthenticated attacker who knows a user ID to forge valid session tokens, including for administrators, by signing claims with an empty key. The vulnerability also permits token refresh without revocation, enabling continued unauthorized access. The issue is fixed in version 0.143.0, which enforces a required JWT secret and changes the default token provider.

SigNoz versions from 0.98.0 up to but not including 0.143.0, when configured to use the opaque session tokenizer, do not revoke existing user login sessions upon password reset or user deletion. This allows an attacker with an existing session token to retain full account access after these actions until the token expires or rotates. The issue is fixed in version 0.143.0.

SigNoz versions up to 0.130.1 have a broken access control vulnerability that allows authenticated users to access and manipulate alert rules belonging to other organizations. This occurs because the alert rule store predicates do not filter by organization ID, resulting in missing tenant isolation. Exploiting this flaw, attackers can read, edit, and delete alert rules across organizations, bypassing multi-tenant access controls. A patch is available in version 0.130.2 to address this issue.