Sentry's improper authentication on SAML SSO process allows user impersonation
Impact
A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.
The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.
Patches
- Sentry SaaS: The fix was deployed on Jan 14, 2025.
- Self-Hosted Sentry: If only a single organization is allowed (
SENTRY_SINGLE_ORGANIZATION = True), then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher.
Workarounds
No known workarounds.
References
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | sentry | >= 21.12.0, < 25.1.0 | 25.1.0 |
References
- https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w
- https://nvd.nist.gov/vuln/detail/CVE-2025-22146
- https://github.com/getsentry/sentry/pull/83407
- https://github.com/getsentry/sentry/commit/6db508f7949d117c7dff748a3c82c3a272bf7cfd
- https://github.com/getsentry/sentry
- https://pypi.org/project/sentry
- https://github.com/advisories/GHSA-7pq6-v88g-wf3w
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-287- Platform
- Python (PyPI)
- Package
sentry- Disclosed
- 15.01.2025
- Updated
- 11.10.2026 13:17
Sources and licenses
OSV / GitHub Advisory Database - GHSA-7pq6-v88g-wf3w - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-532 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: sentry
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 12.2022 05.2026
- Without a fix
- 1
- Exploited in attacks
- 0
Severity breakdown
- Critical 3
- High 7
- Medium 4
- Low 1
Disclosures per year
- 2022: 1
- 2023: 4
- 2024: 6
- 2025: 1
- 2026: 3
-
Sentry's improper authentication on SAML SSO process allows user impersonation this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.