CVE-2026-42354 - Vulnerability Analysis

Overview

Sentry 21.12.0 to < 26.4.1 contains an authentication bypass caused by a malicious SAML Identity Provider in the SAML SSO implementation, letting attackers take over user accounts, exploit requires knowing victim email address.

Severity & Score

Impact

Attackers can take over any user account, leading to full account compromise and unauthorized access.

Mitigation

Update to version 26.4.1 or later.

References

• https://github.com/getsentry/sentry/security/advisories/GHSA-rcmw-7mc7-3rj7
• https://github.com/getsentry/sentry/commit/0c67558ae7fe08738912d4c5233b53ead048da3b
• https://github.com/getsentry/sentry/pull/113720
• https://github.com/getsentry/sentry/releases/tag/26.4.1

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner