Overview

SigNoz contains an authenticated session invalidation vulnerability affecting password resets and user deletion. Existing authentication sessions are not properly revoked when either operation occurs, allowing a previously issued session token to remain valid after the account security state has changed.

Affected Versions

SigNoz >= v0.98.0 and < v0.143.0

Technical Details

SigNoz supports opaque and JWT session tokenizers. With the opaque tokenizer, login sessions are stored in the auth_token table and cached in the SigNoz cache.

The tokenizer provides a DeleteTokensByUserID operation for revoking all sessions belonging to a user. Password changes performed from the account settings correctly invoke this operation, but the password-reset flow and user-deletion flow did not.

When a password is reset through POST /api/v2/factor_password/reset, the new password is stored but existing authentication tokens are not invalidated. Consequently, a previously issued session can remain authenticated until it reaches the configured maximum token lifetime.

Similarly, deleting a user through DELETE /api/v2/users/{id} removes authentication-token records from the database but does not invalidate the corresponding cached token and identity. With the opaque tokenizer, the cached session can therefore remain usable until token rotation requires the session to be revalidated.

Proof of Concept

  1. Authenticate as a victim user through POST /api/v2/sessions/email_password and save the returned accessToken.
  2. As an administrator, generate a password-reset token for the victim.
  3. Reset the victim's password through POST /api/v2/factor_password/reset.
  4. Send an authenticated request to GET /api/v2/users/me using the previously obtained token.
  5. The old token continues to authenticate successfully instead of receiving an HTTP 401 response.
  6. Delete the victim account and immediately repeat the authenticated request. The previously issued token can still authenticate during the vulnerable cache window.

Impact

An attacker who already possesses a valid session token can retain access to the account after its password has been reset. This defeats the expected security property of password reset as a mechanism for invalidating existing sessions and can allow continued access to sensitive account functionality.

The impact is particularly significant when the compromised account has administrative privileges.

After user deletion, an existing opaque-token session may continue to authenticate until the cached session is invalidated or requires rotation. The exact functionality available during this period depends on the affected SigNoz release and the user's remaining role assignments.

CVSS

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Remediation

Upgrade to SigNoz v0.143.0 or later. The patched versions revoke existing sessions when a password is reset or a user is deleted, and the opaque tokenizer becomes the default tokenizer.

CWE

CWE-613: Insufficient Session Expiration