CVE-2026-102899

Awaiting Analysis Awaiting Analysis - Queue

SAML Identity Linking Account Takeover in Sentry

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102899

EUVD

EUVD-2026-101578

Affected Vendors & Products

Vendor	Product	Version / Range
getsentry	sentry	>= 26.5.0, < 26.7.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability affects Sentry versions 26.5.0 to 26.7.2. An attacker controlling a SAML identity provider can trick a logged-in user into opening a malicious URL. This links the attacker's identity to the victim's Sentry account, allowing the attacker to take over the account. The attack works if the browser accepts cross-site cookie contexts, such as Firefox with SameSite=None cookies or Chromium with third-party cookies enabled.

Detection Guidance

This vulnerability involves SAML SSO identity-linking in Sentry versions 26.5.0 to 26.7.1. To detect it, check Sentry logs for unusual SAML authentication attempts or identity-linking events. Look for POST requests to /auth/sso/ with SAML assertions. Ensure your Sentry instance is updated to version 26.7.2 or later.

Impact Analysis

If exploited, an attacker could gain full control of your Sentry account. This could lead to unauthorized access to sensitive data, project modifications, or other actions performed under your identity. The attack requires social engineering to trick you into clicking a malicious link.

Compliance Impact

The vulnerability allows an attacker to take control of a user's Sentry account through a socially engineered SAML SSO attack. This could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy) compliance if such data is processed or stored in Sentry.

Mitigation Strategies

Upgrade Sentry to version 26.7.2 or later to address the SAML SSO authentication flaw.
For self-hosted instances, ensure you are running version 26.7.2 of the self-hosted Sentry release.
Review and update SAML SSO configurations to use the unified authentication flow as described in the fixes.

Hi! I’m here to help you understand CVE-2026-102899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70