CVE-2026-102899
CVE-2026-102899 · Sentry: Improper authentication on SAML SSO process allows user identity linking
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
CVSS 7.6 · Hoch · EPSS 0,4%
- Veröffentlicht
- Aktualisiert
Betroffene Produkte und Versionen
sentry
- Softwareversionen
- >= 26.5.0, < 26.7.2: Betroffen
Keine Korrektur veröffentlicht
Originalquellen
- https://github.com/getsentry/sentry/security/advisories/GHSA-w699-8wff-fqxw
- https://github.com/getsentry/sentry/pull/120467
- https://github.com/getsentry/sentry/pull/120702
- https://github.com/getsentry/sentry/commit/9c982d4bcb81c93e2db552084bcbb45cdd34bdd3
- https://github.com/getsentry/sentry/commit/ec963de4ec8c7f340f286c6f613e55458a9e5ddf
- https://github.com/getsentry/self-hosted/releases/tag/26.7.2
- https://github.com/getsentry/sentry/releases/tag/26.7.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-102899