-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability centers around improper client credential validation during OAuth token exchange. In OAuth flows, the token endpoint must validate that the client making the token request (via client_id/client_secret) matches the client that was originally granted the authorization code. The described attack scenario implies this validation was missing or incomplete in the token endpoint handler. The most logical location for this vulnerability would be in the core token exchange method of the OAuth2 provider implementation, which in Sentry's architecture is typically found in the oauth_token endpoint handler. This matches the CWE-287 classification and the attack pattern described.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| sentry | pip | >= 10.0.0, < 23.7.2 | 23.7.2 |
Ongoing coverage of React2Shell