User Impersonation Affecting sentry package, versions [21.12.0,]

Affected versions of this package are vulnerable to User Impersonation through the AuthHelper SSO setup flow in the auth helper pipeline. An attacker can link a Sentry account to a different identity by supplying an IdP assertion email that resolves to another user during provider setup. This causes the newly configured SSO identity to be attached to the wrong account, letting the attacker assume an unintended user identity and leaving the organization’s SSO configuration bound to the wrong member.

Notes

• The takeover path depends on the victim email already being known and on the IdP assertion resolving to an existing Sentry user record during setup; if the assertion email does not map to a user, the misbinding condition described in the advisory does not arise.
• While a fix was included in 26.4.1, Sentry stopped publishing packages to PyPI since 23.7.1; for additional information, see this issue in the maintainer's repository.

Workarounds

• Enable user account two-factor authentication, especially for organization admins. This prevents an attacker from completing authentication as a victim account even if they can trigger the SSO linking flow.

• GitHub Commit
• GitHub PR
• Maintainer's Advisory