CVE-2026-42354 is an authentication bypass vulnerability categorized under CWE-290 affecting Sentry's SAML SSO implementation in versions >= 21.12.0 and < 26.4.1. The flaw allows an attacker who controls a malicious SAML Identity Provider and has access to another organization on the same Sentry instance to impersonate any user by spoofing authentication, provided the victim's email address is known. This enables full account takeover without requiring prior privileges or user interaction. The vulnerability was addressed and patched in Sentry version 26.4.1.

Successful exploitation results in complete compromise of user accounts, allowing attackers to bypass authentication controls and assume the identity of any user on the affected Sentry instance. This leads to unauthorized access to sensitive error tracking and performance monitoring data. The vulnerability does not affect availability but severely impacts confidentiality and integrity.

Upgrade Sentry to version 26.4.1 or later, where this vulnerability has been patched. Since this is an on-premises product, administrators must apply the update manually. Patch status is confirmed by the vendor advisory stating the fix is included in version 26.4.1. No other mitigations are indicated.