Sentry is an application monitoring and error tracking platform. From 26.5.0 until 26.7.2, the SAML SSO identity-linking flow allows an attacker who controls a SAML identity provider to socially engineer an authenticated user into opening a malicious URL, link the attacker's identity to the victim's Sentry account, and take control of that account. The attack requires a browser that accepts the cross-site cookie context, including Firefox with SameSite=None cookies or Chromium with third-party cookies enabled.
Sentry SaaS received the remediation on July 27, 2026, and self-hosted Sentry is fixed in version 26.7.2.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 7
https://github.com/getsentry/self-hosted/releases/tag/26.7.2
security-advisories@github.com
https://github.com/getsentry/sentry/commit/9c982d4bcb81c93e2db552084bcbb45cdd34…
security-advisories@github.com
https://github.com/getsentry/sentry/commit/ec963de4ec8c7f340f286c6f613e55458a9e…
security-advisories@github.com
https://github.com/getsentry/sentry/pull/120467
security-advisories@github.com
https://github.com/getsentry/sentry/pull/120702
security-advisories@github.com
https://github.com/getsentry/sentry/releases/tag/26.7.2
security-advisories@github.com
https://github.com/getsentry/sentry/security/advisories/GHSA-w699-8wff-fqxw
security-advisories@github.com