Impact
A critical vulnerability was discovered in the SAML SSO implementation of Sentry. This issue was reported to us via our private bug bounty program.
The vulnerability allows an attacker to take control of any authenticated Sentry user account by using an attacker-controlled SAML Identity Provider and social engineering a user into clicking a malicious URL.
This issue specifically affects users accessing Sentry with:
- Browsers that honor SameSite=None cookies, including Firefox
- Chromium-based browsers with third-party cookies manually enabled
Patches
- Sentry SaaS: Two fixes were deploy on on July 27, 2026 and July 27, 2026. No action is required for SaaS users.
- Self-Hosted Sentry: The fix is to scope
op to Sentry's own confirmation pages and ignore it when the request contains a SAMLResponse.
Workarounds
You can mitigate this by accessing Sentry using a Chromium based browser with third party cookies disabled.
References
Muhammad-Qasim-Munir Reporter
Impact
A critical vulnerability was discovered in the SAML SSO implementation of Sentry. This issue was reported to us via our private bug bounty program.
The vulnerability allows an attacker to take control of any authenticated Sentry user account by using an attacker-controlled SAML Identity Provider and social engineering a user into clicking a malicious URL.
This issue specifically affects users accessing Sentry with:
Patches
opto Sentry's own confirmation pages and ignore it when the request contains aSAMLResponse.Workarounds
You can mitigate this by accessing Sentry using a Chromium based browser with third party cookies disabled.
References