Sentry's improper authentication on SAML SSO process allows user impersonation

The impact of CVE-2025-22146 is severe. An attacker can exploit this vulnerability to gain unauthorized access to user accounts within a Sentry instance. This is achieved by crafting a malicious SAML Identity Provider response and tricking a user into authenticating through it. Critically, the attacker needs to know the victim's email address to successfully exploit the vulnerability. Successful exploitation grants the attacker full access to the compromised user's Sentry account, including the ability to view sensitive project data, configure alerts, and potentially access other integrated systems. The shared nature of Sentry instances amplifies the risk, as a compromised account could provide a foothold for lateral movement within an organization.

Organizations using Sentry for error tracking and performance monitoring, particularly those relying on SAML SSO for user authentication, are at risk. This includes teams with shared Sentry instances across multiple organizations or departments, as the vulnerability can be exploited to compromise accounts across these shared environments. Users who have not upgraded to the patched version of Sentry are also at significant risk.

• python / server: Monitor Sentry logs for unusual SAML authentication attempts or errors related to SAML processing. Look for patterns indicative of malicious SAML requests.

# Example: grep for SAML errors in Sentry logs
grep 'SAML error' /var/log/sentry/error.log

• generic web: Examine Sentry's access logs for requests originating from unfamiliar or suspicious IP addresses attempting SAML authentication.

# Example: Check access logs for SAML requests from unknown IPs
awk '/SAML/ {print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -10

1. 2025-01-14Patch

   patch

2. 2025-01-15Disclosure

   disclosure

1. Reserviert2024-12-30
2. Veröffentlicht2025-01-15
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-22146 is to upgrade to Sentry version 25.1.0 or later. For Sentry SaaS users, the fix was deployed on January 14, 2025, so ensure your instance is running the latest version. Self-hosted Sentry users should apply the patch available in version 25.1.0. If immediate upgrading is not possible, consider restricting SAML SSO to trusted Identity Providers and carefully reviewing any new SAML configurations. While not a complete solution, implementing multi-factor authentication (MFA) can add an additional layer of security and make account takeover more difficult. After upgrading, confirm the fix by attempting a SAML login with a test user and verifying that the authentication process is secure.