CVE-2026-102899: CWE-287: Improper Authentication in getsentry sentry

Sentry versions from 26.5.0 up to but not including 26.7.2 contain a vulnerability in the SAML SSO identity-linking flow. This flaw allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into visiting a crafted URL. When the user’s browser accepts cross-site cookies (e.g., Firefox with SameSite=None or Chromium with third-party cookies enabled), the attacker’s identity can be linked to the victim’s Sentry account, resulting in account takeover. The vulnerability is classified as CWE-287 (Improper Authentication). The Sentry SaaS service was patched on July 27, 2026, and the self-hosted versions are fixed starting with 26.7.2.

Successful exploitation allows an attacker to take control of a victim’s Sentry account by linking the attacker’s SAML identity to the victim’s account. This compromises account integrity and potentially exposes sensitive monitoring and error tracking data. The attack requires user interaction and specific browser cookie settings, limiting but not eliminating the risk.

Upgrade self-hosted Sentry installations to version 26.7.2 or later to remediate this vulnerability. For Sentry SaaS users, the vendor applied the fix on July 27, 2026, so no additional action is required. Users should also be cautious about opening unsolicited URLs, especially when using browsers configured to accept cross-site cookies. Patch status is confirmed fixed in 26.7.2 for self-hosted and already remediated for SaaS.