Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: signoz 0.143.0 Clear all filters
TI-2026-63931 CVE-2026-97056 · GHSA-r949-5536-p6gg

SigNoz before 0.143.0 Insufficient Session Expiration Authentication Bypass

Priority HIGH 68

SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the default before v0.143.0), do not revoke a user's existing login sessions when the us…

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00435 Published 2026-09-24 Fixed in 0.143.0 CWE-613
TI-2026-63930 CVE-2026-97055 · GHSA-m7r9-jq4r-hmr3

SigNoz before 0.143.0 Authentication Bypass via Empty JWT Secret

Priority HIGH 75

SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or the deprecated SIGNOZ_JWT_SECRET) to an empty string, and Config.Validate() doe…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0053 Published 2026-09-24 Fixed in 0.143.0 CWE-1188