CVE-2026-102899: Sentry: Improper authentication on SAML SSO process allows user identity linking
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sentryto a version that resolves this vulnerability.Fixed in 26.7.2
Event History
Frequently Asked Questions
Which deployments and versions need attention?
Self-hosted Sentry versions from 26.5.0 up to, but not including, 26.7.2 are affected. Sentry SaaS received remediation on July 27, 2026.
What must an attacker be able to do to exploit this issue?
The attacker must control a SAML identity provider and socially engineer an authenticated user into opening a malicious URL. Exploitation also depends on the user's browser accepting the required cross-site cookie context.
Are all user browsers equally exposed?
No. The described attack requires a browser that accepts cross-site cookie context, such as Firefox when SameSite=None cookies are used or Chromium when third-party cookies are enabled.
What is the immediate remediation for self-hosted Sentry?
Upgrade self-hosted Sentry to version 26.7.2, which contains the fix.