The vulnerability exists in the SAML SSO identity‑linking flow of Sentry versions 26.5.0 through 26.7.2. An attacker who controls a SAML identity provider can guide a logged‑in user to open a crafted URL, causing the user's browser to send credentials to the attacker’s identity, thus linking the attacker’s identity to the victim's Sentry account. This results in the attacker gaining full control of that account, including data access, configuration changes, and the ability to perform actions as the victim. The weakness is identified as CWE‑287, indicating improper authentication.

Affected product is GetSentry Sentry, the application monitoring platform. Self‑hosted installations running any version from 26.5.0 up to but not including 26.7.2 are vulnerable. The SaaS service was remediated on July 27, 2026; for self‑hosted deployments the fix is included in release 26.7.2.

The CVSS base score is 7.6, signifying high severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker‑controlled SAML IdP and a user’s browser that accepts cross‑site cookie context (e.g., Firefox with SameSite=None or Chromium with third‑party cookies enabled). The attacker must socially engineer the victim into visiting a malicious URL, after which the link between identities is forged and the victim’s account is hijacked. The attack vector is remote and requires user interaction but does not need additional network or privileged access.