Authentication Bypass Vulnerability in SigNoz
CVE-2026-97055

9.2CRITICAL

Key Information:

Vendor

Signoz

Status
Signoz
Vendor
CVE Published:
24 September 2026

What is CVE-2026-97055?

An authentication bypass vulnerability exists in SigNoz versions before 0.143.0 due to the use of an empty JWT signing secret, allowing attackers to forge valid session tokens. Without proper configuration, any deployment can operate with an empty HMAC key, enabling unauthenticated users to create valid tokens for existing users. This could potentially include administrative accounts, making it a serious security concern. The flaw was addressed in SigNoz version 0.143.0, which requires a defined JWT secret and alters the default provider settings.

Affected Version(s)

signoz 0.8.0 < 0.143.0

signoz 0.143.0

References

https://github.com/SigNoz/signoz/security/advisories/GHSA...
vendor-advisory
https://github.com/SigNoz/signoz/commit/67895d366d
patch
https://github.com/SigNoz/signoz/commit/b02aae2db3
patch

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

PLpaPLpa
.