CVE Intelligence
Analysis AI-assisted

CVE-2026-27197: Sentry: Improper Authentication in SAML SSO Allows User Identity Linking

A critical improper authentication flaw (CWE-287) in the SAML SSO implementation of Sentry allows an attacker to take over user accounts by using a malicious SAML Identity Provider on the same instance. The record states the issue is fixed in version 26.2.0 and recommends user account-based two-factor authentication as a workaround. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Sentry is a developer-focused error tracking and performance monitoring tool. CVE-2026-27197 is a critical improper authentication issue in its SAML SSO process that can allow user identities to be linked to the wrong account. The record classifies it as CWE-287 and reports a CVSS base score of 9.1 provided by GitHub as the CNA.

Impact

  • According to the record, an attacker can take over any user account by using a malicious SAML Identity Provider together with another organization on the same Sentry instance.
  • The CVSS data in the record indicates high confidentiality and high integrity impact, with no availability impact.
  • Self-hosted deployments are affected only under the conditions described in the next section.

Affected products and versions

  • The record lists Getsentry Sentry and Sentry Sentry as affected from 21.12.0 up to before 26.2.0.
  • The description states that versions 21.12.0 through 26.1.0 have the vulnerability, and that it is fixed in 26.2.0.
  • For self-hosted installations, the record describes two conditions: more than one organization is configured (with SENTRY_SINGLE_ORGANIZATION set to True), or a malicious user already has permissions to modify SSO settings for another organization in a multi-organization instance.

Exploitation status

  • CISA KEV does not list this CVE in the data consulted, so active exploitation is not confirmed by that source.
  • No confirmed exploitation appears in the sources consulted.
  • The record shows an EPSS probability of 0.00651 and an SSVC exploitation value of none, with automatable set to no. These are estimates and do not confirm real-world activity.

Remediation and mitigation

  • The record states the issue is fixed in version 26.2.0. Upgrading to that version or a later release is the recommended path.
  • Until the upgrade is applied, the record recommends enabling user account-based two-factor authentication to make it harder for an attacker to complete authentication with a victim account.
  • Administrators cannot enable 2FA on behalf of users. Each user must enable it on their own account.
  • Review which accounts can modify SSO settings, especially in multi-organization instances, and limit that access to what is required.
  • Consult the GitHub security advisory for complete remediation details.

Detection guidance

  • Review audit records for recent changes to SAML SSO settings and identity provider configurations in each organization.
  • Look for unexpected SSO logins or account linking events, particularly those involving more than one organization.
  • Confirm 2FA status for accounts with administrative or sensitive access.
  • The sources consulted do not describe specific log signatures, so these are general defensive recommendations.

Limitations of the available information

  • The self-hosted conditions in the source description contain garbled text, so the exact configuration criteria should be verified in the GitHub advisory.
  • The record does not describe whether 2FA blocks every possible attack path, only that it is the recommended workaround.
  • No indicators of compromise or detection rules are provided in the record.
  • The record does not describe versions newer than 26.2.0 or any other fix beyond 26.2.0.

Frequently asked questions

What is CVE-2026-27197?

It is a critical improper authentication flaw (CWE-287) in the SAML SSO process of Sentry that can allow an attacker to take over user accounts using a malicious SAML Identity Provider on the same instance.

Which Sentry versions are affected?

The record states that versions 21.12.0 through 26.1.0 are affected, and that the issue is fixed in version 26.2.0.

Is there a workaround before upgrading?

The record recommends enabling user account-based two-factor authentication. Each user must enable it on their own account, because administrators cannot do it for them.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.