Sentry’s SAML SSO implementation contains an unauthorized identity linkage flaw (CWE‑290). When an attacker controls a malicious SAML Identity Provider and presents an email address that exists on the target instance, the system accepts the authentication and binds it to the victim’s account. This bypasses normal credential verification, enabling the attacker to assume full control of the user account with all its permissions.

Sentry installations from version 21.12.0 up to, but not including, 26.4.1 are susceptible. The affected vendor is getsentry:sentry. Attackers must know the target user’s email address and have the ability to configure a rogue SAML provider that the Sentry instance trusts.

The CVSS score of 9.1 indicates critical severity. No EPSS data is available, but the requirement for a known email address and a malicious SAML provider suggests that remote exploitation is likely available to attackers who can set up such a provider or compromise an existing trusted IdP. The vulnerability is not listed in the CISA KEV catalog, yet the high CVSS and the potential for complete account takeover warrant urgent remediation. The attack vector is inferred to be remote, relying on the SAML SSO trust relationship and knowledge of user emails.