SigNoz Authentication and Session Management Flaws

Session token forgery in SigNoz v0.8.0 through v0.142.x allows unauthenticated attackers to impersonate any user, including administrators, when the default JWT tokenizer provider runs without a configured signing secret. The application defaults the JWT HMAC key to an empty string and fails to reject this in Config.Validate(), so tokens are both signed and verified with an empty key; an attacker who knows a target user ID can forge valid access and refresh tokens, and the refresh token can be rotated at /api/v2/sessions/rotate and cannot be revoked. No public exploit identified at time of analysis; deployments that explicitly set a secret or use the opaque provider are not affected, and v0.143.0 eliminates the exposure.

SigNoz deployments configured to use the non-default opaque session tokenizer leave existing sessions valid after a password reset or user deletion, so a remote authenticated attacker who already holds a live session token for an account retains that account's full access - up to administrator - for up to the token's configured maximum lifetime (30 days by default) after a reset, and until the token next rotates (30 minutes by default) after deletion. Affected versions run from v0.98.0 up to but not including v0.143.0; default installations in that range never used the opaque tokenizer and are therefore not exposed. The vendor has released v0.143.0 as the fix, and no public exploit code or confirmed active exploitation was identified at time of analysis.