getsentry Sentry up to 26.7.1 SAML SSO Identity-Linking Flow improper authentication

Summaryinfo

A vulnerability has been found in getsentry Sentry up to 26.7.1 and classified as critical. This issue affects some unknown processing of the component SAML SSO Identity-Linking Flow. This manipulation causes improper authentication. This vulnerability is registered as CVE-2026-102899. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in getsentry Sentry up to 26.7.1. It has been declared as critical. Affected by this vulnerability is an unknown part of the component SAML SSO Identity-Linking Flow. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-102899 since 09/29/2026. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

Upgrading to version 26.7.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• getsentry

Name

• Sentry

Version

• 26.7.0
• 26.7.1

Website

• Product: https://github.com/getsentry/sentry/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion