SigNoz versions from 0.8.0 up to but not including 0.143.0 have a vulnerability where the JWT tokenizer signing secret defaults to an empty string if not configured. This allows an unauthenticated attacker who knows a user ID to forge valid session tokens, including for administrators, by signing claims with an empty key. The vulnerability also permits token refresh without revocation, enabling continued unauthorized access. The issue is fixed in version 0.143.0, which enforces a required JWT secret and changes the default token provider.