SigNoz versions from 0.98.0 up to but not including 0.143.0, when configured to use the opaque session tokenizer, do not revoke existing user login sessions upon password reset or user deletion. This allows an attacker with an existing session token to retain full account access after these actions until the token expires or rotates. The issue is fixed in version 0.143.0.