Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. This issue was reported to us via our private bug bounty program. The vulnerability allows an attacker to take control of any authenticated Sentry user account by using an attacker-controlled SAML Identity Provider and social engineering a user into clicking a malicious URL. This issue specifically affects users accessing Sentry with: - Browsers that honor SameSite=None cookies, including Firefox - Chromium-based browsers with third-party cookies manually enabled ### Patches - "Sentry SaaS" (https://sentry.io/): Two fixes were deploy on on July 27, 2026 and July 27, 2026. No action is required for SaaS users. - "Self-Hosted Sentry" (https://github.com/getsentry/self-hosted/releases/tag/26.7.2): The fix is to scope "op" to Sentry's own confirmation pages and ignore it when the request contains a "SAMLResponse". ### Workarounds You can mitigate this by accessing Sentry using a Chromium based browser with third party cookies disabled. ### References - https://github.com/getsentry/sentry/pull/120467 - https://github.com/getsentry/sentry/pull/120702