CVE-2026-42354

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42354
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42354.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42354
Aliases
Downstream
Published
2026-05-08T22:58:33.659Z
Modified
2026-08-12T03:51:33.964822349Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Sentry: Improper authentication on SAML SSO process allows user identity linking
Details

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.

Database specific 
{
    "cwe_ids": [
        "CWE-290"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42354.json"
}
References

Affected packages

Git / github.com/getsentry/sentry

Affected ranges

Type
GIT
Repo
https://github.com/getsentry/sentry
Events
Introduced
5cd2287820d7a1314c0437682de8d0e79ad316b2
Fixed
e93c05476971a36729b28a08bb72abbfef82cf36
Fixed
0c67558ae7fe08738912d4c5233b53ead048da3b
Database specific
Show details 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "21.12.0"
        },
        {
            "fixed": "26.4.1"
        }
    ],
    "cpe": "cpe:2.3:a:sentry:sentry:*:*:*:*:*:*:*:*"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42354.json"