Improper Authentication in sentry - CVE-2023-39531
Published: August 9, 2023 / Updated: April 23, 2026
Vulnerability identifier: #VU126920
CSH Severity: Low
CVSS v4: 5.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-39531
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to obtain a valid access token for another user.
The vulnerability exists due to improper authentication in OAuth token requests when processing the OAuth token exchange. A remote user can submit a crafted token request to obtain a valid access token for another user.
The client ID must be known, the API application must already be authorized on the targeted user account, and user interaction is required.
Affected software
sentry
How to mitigate CVE-2023-39531
Install security update from vendor's website.
sentry - update to 23.7.2