You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
An attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a user's account. With a specially timed requests and redirect flows, an attacker could generate multiple authorization codes that could be used to exchange for access and refresh tokens. This was possible even after de-authorizing the particular application.
Note
A user must explicitly authorize the OAuth application on their account during the authorization code flow.
The OAuth application will only have the same level of access of the particular user in the target organization; even if it requests higher-privileged scopes.
Patches
Self-hosted Sentry users should upgrade to version 25.5.0 or higher.
Sentry SaaS users do not need to take any action.
Workarounds
There are no known workarounds available for this vulnerability. Sentry self-hosted users should upgrade to 25.5.0 or higher.
Impact
An attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a user's account. With a specially timed requests and redirect flows, an attacker could generate multiple authorization codes that could be used to exchange for access and refresh tokens. This was possible even after de-authorizing the particular application.
Note
Patches
Workarounds
There are no known workarounds available for this vulnerability. Sentry self-hosted users should upgrade to 25.5.0 or higher.
References