CVE-2026-102899

UNKNOWN 0.0

Sentry: Improper authentication on SAML SSO process allows user identity linking

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.

CWE	CWE-287
Vendor	getsentry
Product	sentry
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for getsentry sentry

Be the first to know when new unknown vulnerabilities affecting getsentry sentry are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

getsentry / sentry

>= 26.5.0, < 26.7.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getsentry/sentry/security/advisories/GHSA-w699-8wff-fqxw github.com: https://github.com/getsentry/sentry/pull/120467 github.com: https://github.com/getsentry/sentry/pull/120702 github.com: https://github.com/getsentry/sentry/commit/9c982d4bcb81c93e2db552084bcbb45cdd34bdd3 github.com: https://github.com/getsentry/sentry/commit/ec963de4ec8c7f340f286c6f613e55458a9e5ddf github.com: https://github.com/getsentry/self-hosted/releases/tag/26.7.2 github.com: https://github.com/getsentry/sentry/releases/tag/26.7.2