CVE-2023-39531

    Dashboard / Vulnerabilities / CVE-2023-39531

    CVE-2023-39531

    Published: 9 Aug 2023Last Modified: 12 Aug 2026

    Summary: Sentry vulnerable to incorrect credential validation on OAuth token requests

    Details: Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted user account. Sentry SaaS customers do not need to take any action. Self-hosted installations should upgrade to version 23.7.2 or higher. There are no direct workarounds, but users should review applications authorized on their account and remove any that are no longer needed.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39531.json, https://github.com/getsentry/sentry/security/advisories/GHSA-hgj4-h2x3-rfx4, https://nvd.nist.gov/vuln/detail/CVE-2023-39531

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- ebb7e5c8efea051f285a7236b574c148875a16e3
    Fixed -adbbcd8cfb0406be8647c6763a243e171de3d84a

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39531 | CVE-DB