9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42354

CVE-2026-42354: Sentry: Improper authentication on SAML SSO process allows user identity linking

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability. This issue has been patched in version 26.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42354

CVE-2026-42354:

9.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sentry	pip	>= 21.12.0, <= 26.4.0	26.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in Sentry's SAML SSO setup process, where an attacker with SSO configuration privileges could take over another user's account. The core of the issue is in the AuthHelper._finish_setup_pipeline function located in src/sentry/auth/helper.py. This function is responsible for finalizing the link between an SSO identity and a Sentry user account. The vulnerability stems from the function's implicit trust in the email address provided within the SAML assertion from the Identity Provider (IdP). An attacker could set up a malicious IdP and craft a SAML response containing the victim's email address. The vulnerable _finish_setup_pipeline function would then process this malicious assertion and incorrectly associate the attacker's SSO identity with the victim's Sentry account, leading to an account takeover. The analysis of commit 0c67558ae7fe08738912d4c5233b53ead048da3b shows that the fix involves ignoring the email from the IdP's assertion and instead using the email of the currently logged-in administrator (request.user.email) who is performing the setup. This change guarantees that the SSO identity is linked only to the administrator's account, thereby preventing the impersonation attack.

Vulnerable functions

AuthHelper._finish_setup_pipeline

src/sentry/auth/helper.py

This function completes the SAML SSO setup process. In the vulnerable version, it directly uses the `identity` object, which includes an email address provided by the Identity Provider (IdP), to link to a Sentry user. An attacker could provide a malicious SAML assertion with a victim's email address, causing this function to link the attacker's SSO session to the victim's account. The patch mitigates this by overwriting the email in the identity object with the email of the currently authenticated user performing the setup, ensuring the identity is always linked to the correct admin account.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.