Sentry SAML SSO User Account Takeover Vulnerability

A critical vulnerability exists in the SAML Single Sign-On (SSO) implementation of Sentry, versions 21.12.0 through 24.12.1. This vulnerability allows an attacker to take over any user account by exploiting a malicious SAML Identity Provider and targeting another organization on the same Sentry instance. The attack requires knowledge of the victim's email address.

Impact

Exploitation of this vulnerability allows for unauthorized account access, enabling an attacker to impersonate the victim user.

Remediation

Users of self-hosted Sentry should upgrade to version 25.1.0 or higher, unless only a single organization is allowed, in which case no action is needed. Sentry SaaS users have already received the patch.