CVE-2026-102899
CVE-2026-102899 · Sentry: Improper authentication on SAML SSO process allows user identity linking
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
CVSS 7.6 · High · EPSS 0.4%
- Published
- Updated
Affected products and versions
sentry
- Versions
- >= 26.5.0, < 26.7.2: Affected
No fix published
Original sources
- https://github.com/getsentry/sentry/security/advisories/GHSA-w699-8wff-fqxw
- https://github.com/getsentry/sentry/pull/120467
- https://github.com/getsentry/sentry/pull/120702
- https://github.com/getsentry/sentry/commit/9c982d4bcb81c93e2db552084bcbb45cdd34bdd3
- https://github.com/getsentry/sentry/commit/ec963de4ec8c7f340f286c6f613e55458a9e5ddf
- https://github.com/getsentry/self-hosted/releases/tag/26.7.2
- https://github.com/getsentry/sentry/releases/tag/26.7.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-102899