SAML SSO Flaw in Sentry by Getsentry Allows Account Takeover
CVE-2026-102899

7.6HIGH

Key Information:

Vendor

Getsentry

Status
Sentry
Vendor
CVE Published:
14 October 2026

What is CVE-2026-102899?

A vulnerability exists in Sentry that impacts versions from 26.5.0 to 26.7.2, which allows an attacker controlling a SAML identity provider to manipulate an authenticated user into accessing a malicious URL. This manipulation can link the attacker's identity to the victim's Sentry account, enabling unauthorized control over that account. Notably, this attack is facilitated only through browsers that accept cross-site cookies, specifically instances using Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Remediation was achieved for Sentry SaaS on July 27, 2026, and for self-hosted instances in version 26.7.2.

Affected Version(s)

sentry >= 26.5.0, < 26.7.2

References

https://github.com/getsentry/sentry/security/advisories/G...
x_refsource_CONFIRM
https://github.com/getsentry/sentry/pull/120467
x_refsource_MISC
https://github.com/getsentry/sentry/pull/120702
x_refsource_MISC

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.