The issue lies in SigNoz's opaque session tokenizer, which does not invalidate existing session tokens when a user resets their password or is deleted. Because the session tokens remain valid, an attacker who already possesses a token—such as from a stolen browser session or an offboarded user—maintains the account’s full privileges, including administrator rights, for the configured token lifetime. This vulnerability results in an authentication bypass that allows compromised sessions to persist beyond password changes or user removal.

SigNoz versions starting at 0.98.0 and extending up to, but not including, 0.143.0 are affected when configured to use the opaque session tokenizer. Systems running any of these releases that have enabled this tokenizer are susceptible. Upgrading to v0.143.0 fixes the issue.

With a CVSS score of 7.6 the vulnerability is categorized as High severity. The EPSS score is not provided. Because the session tokens remain valid after a password reset or user deletion, an attacker who holds a session token can maintain full account privileges for the token’s lifetime, which is defined by default as up to 30 days or 30 minutes after deletion. This makes the flaw a post‑compromise authentication bypass that does not require code execution. The lack of session revocation is a security weakness, and it is not listed in the CISA KEV catalog. Based on the description, it is inferred that the risk grows with longer session lifetimes because tokens may remain valid for longer periods; however this inference is not explicitly stated in the input.