CVE-2025-53099
BaseFortify
Publication date: 2025-07-01
Last updated on: 2025-09-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sentry | sentry | to 25.5.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-288 | The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-53099 is a vulnerability in Sentry versions prior to 25.5.0 where an attacker who registers a malicious OAuth application can exploit a race condition and improper handling of authorization codes. This allows the attacker to generate multiple valid authorization codes through specially timed requests and redirect flows, which can then be exchanged for access and refresh tokens. This means the attacker can maintain persistent access to a user's account even after the OAuth application has been de-authorized. The root cause is missing locking mechanisms during the authorization code grant exchange and insufficient cleanup of API grants upon revocation. [5, 7, 6]
How can this vulnerability impact me? :
This vulnerability can allow an attacker to maintain persistent unauthorized access to a user's Sentry account by exploiting the race condition to generate multiple valid authorization codes and exchange them for access and refresh tokens. Even after the user de-authorizes the malicious OAuth application, the attacker can still use these tokens to access the account. This compromises account security and could lead to unauthorized access to sensitive error tracking and performance monitoring data. [5, 7, 3]
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-53099, immediately upgrade any self-hosted Sentry instances to version 25.5.0 or higher, as this version includes patches that fix the race condition and improper handling of OAuth authorization codes. The fix involves proper locking mechanisms to prevent concurrent reuse of authorization grants and thorough cleanup of API grants and tokens upon revocation. Sentry SaaS users do not need to take any action. [5, 1, 3, 6, 7]