CVE-2026-42354

CRITICAL 9.1

Sentry: Improper authentication on SAML SSO process allows user identity linking

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.

CWE	CWE-290
Vendor	getsentry
Product	sentry
Published	May 8, 2026

Stay Ahead of the Next One

Get instant alerts for getsentry sentry

Be the first to know when new critical vulnerabilities affecting getsentry sentry are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

getsentry / sentry

>= 21.12.0, < 26.4.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/getsentry/sentry/security/advisories/GHSA-rcmw-7mc7-3rj7 github.com: https://github.com/getsentry/sentry/pull/113720 github.com: https://github.com/getsentry/sentry/commit/0c67558ae7fe08738912d4c5233b53ead048da3b github.com: https://github.com/getsentry/sentry/releases/tag/26.4.1