Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102899— Sentry: Improper authentication on SAML SSO process allows user identity linking

Quick assessment

Affected
getsentry sentry
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sentry 是一个应用监控和错误追踪平台。在版本 26.5.0 至 26.7.2 之间，SAML SSO（单点登录）的身份关联流程存在安全漏洞，使得攻击者可以通过控制一个 SAML 身份提供商（Identity Provider），对社会工程学手段诱骗已认证的用户打开恶意 URL，从而将攻击者的身份与受害者的 Sentry 账户进行关联，并最终接管该账户的控制权。 该攻击要求浏览器接受跨站 Cookie 上下文，例如使用 SameSite=None 的 Firefox 浏览器，或启用了第三方 Cookie 的 C

CVSS 7.6 · High EPSS 0.36% · P29

Affected Version Matrix 1

VendorProduct Version RangeStatus
getsentry sentry >= 26.5.0, < 26.7.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102899

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Sentry: Improper authentication on SAML SSO process allows user identity linking
Source: CVE Program / CVE List V5
Vulnerability Description
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getsentry sentry >= 26.5.0, < 26.7.2 -

II. Public POCs for CVE-2026-102899

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102899

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-102899 (4)

Other References for CVE-2026-102899 (3)

IV. Related Vulnerabilities

Same product: sentry
Same vendor: getsentry
Same weakness: CWE-287

V. Comments for CVE-2026-102899

No comments yet

Leave a comment