Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.6
CVE-2026-102899: Sentry accounts can be hijacked through SAML sign-in link
CVE-2026-102899 · published 1 day ago
Summary
Versions of Sentry from 26.5.0 up to 26.7.2 let a malicious sign‑in provider trick a logged‑in user into clicking a crafted link, which then links the attacker’s identity to the victim’s account and gives the attacker control. The problem only appears when the browser accepts third‑party cookies. Upgrade self‑hosted Sentry to version 26.7.2 (SaaS was fixed on July 27, 2026) to stop the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| getsentry | sentry | >= 26.5.0, < 26.7.2 |
Original advisory text
Sentry: Improper authentication on SAML SSO process allows user identity linking
Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled. Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
References
- https://github.com/getsentry/sentry/releases/tag/26.7.2
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-1028... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-102899 Vendor Advisory
- https://github.com/getsentry/self-hosted/releases/tag/26.7.2
- https://github.com/getsentry/sentry/commit/9c982d4bcb81c93e2db552084bcbb45cdd34b...
- https://github.com/getsentry/sentry/commit/ec963de4ec8c7f340f286c6f613e55458a9e5...
- https://github.com/getsentry/sentry/pull/120467
- https://github.com/getsentry/sentry/pull/120702
- https://github.com/getsentry/sentry/security/advisories/GHSA-w699-8wff-fqxw
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen14 Oct 2026
Sources
CVE-2026-102899 · NVD
CVE-2026-102899 · MITRE
CVE-2026-102899 · OSV
GHSA-w699-8wff-fqxw · GHSA
Track software like this
Free during beta