CVE-2025-53099 Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Medium 5.5 Published 1 Jul 2025 Updated 1 Jul 2025

Attackers can maintain account persistence via race conditions in OAuth code handling, requiring self-hosted users to upgrade.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-53099?

CVE-2025-53099 is a medium-severity vulnerability in getsentry sentry, published on 1 Jul 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a user's account. With a specially timed requests and redirect flows, an attacker could generate multiple authorization codes that could be used to exchange for access and refresh tokens. This was possible even after de-authorizing the particular application. This issue has been patched in version 25.5.0. Self-hosted Sentry users should upgrade to version 25.5.0 or higher. Sentry SaaS users do not need to take any action.

Weakness: CWE-288

Which versions are affected by CVE-2025-53099?

It affects 1 product.

Products include Sentry Sentry.

How do I fix CVE-2025-53099?

No fix has been published for CVE-2025-53099 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-53099 being exploited?

There is no known exploitation of CVE-2025-53099 in the wild and no public exploit code.

Sources

Also known as GHSA-mgh8-h4xc-pfmj.