A session management flaw in SigNoz allows attackers to maintain unauthorized access to accounts even after a password reset or user deletion, posing a significant risk to data integrity and security.

This is an instance of insufficient session expiration (CWE-613) where the application fails to invoke the session revocation function during password resets or user deletions. The vulnerability requires an authenticated attacker to possess a previously valid session token, which remains active despite security-critical account changes.

Successful exploitation of this vulnerability permits an attacker to retain persistent access to a compromised or offboarded user account, potentially including administrative privileges. This undermines the effectiveness of incident response efforts, such as forcing a password reset or disabling a user, and could lead to unauthorized data access or system configuration changes. While the CVSS score is 6.8, the ability to bypass access termination procedures significantly elevates the operational risk.

Immediate Action: Update SigNoz to version 0.143.0 or later immediately to ensure proper session revocation logic is applied.

Proactive Monitoring: Review authentication logs and session activity for anomalous login patterns or connections originating from unexpected locations, especially for accounts that have recently undergone password changes.

Compensating Controls: If immediate patching is not possible, organizations should implement stringent session timeout policies and consider manual session invalidation via backend database management if supported by the infrastructure.

Public Exploit Available: Unknown

The inability to terminate access for compromised accounts represents a critical failure in identity and access management. Administrators are urged to prioritize the update to version 0.143.0 to restore the integrity of the session revocation process and prevent unauthorized persistent access.