CVE-2025-53099: Sentry OAuth Race Condition Vulnerability

CVE-2025-53099 Overview

Sentry is a developer-first error tracking and performance monitoring platform used by engineering teams to identify and triage application failures. CVE-2025-53099 affects Sentry versions prior to 25.5.0 and stems from a race condition in the OAuth authorization code handling logic. An attacker controlling a malicious OAuth application registered with Sentry can issue precisely timed requests through the redirect flow to generate multiple authorization codes. Those codes can be exchanged for access and refresh tokens, granting persistent access to a victim's account even after the user de-authorizes the application. The flaw is tracked under [CWE-288] (Authentication Bypass Using an Alternate Path or Channel).

Critical Impact
An attacker with a malicious OAuth app can maintain persistent token-based access to a user's Sentry account even after the user revokes authorization.

Affected Products

Sentry self-hosted versions prior to 25.5.0
Sentry OAuth application authorization flow
Sentry SaaS customers are not affected and require no action

Discovery Timeline

2025-07-01 - CVE-2025-53099 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53099

Vulnerability Analysis

The vulnerability is a race condition in Sentry's OAuth 2.0 authorization code grant flow. When a user grants an OAuth application access to their account, Sentry issues an authorization code that the client exchanges for access and refresh tokens. The flaw allows a malicious OAuth application to send specially timed concurrent requests during the redirect flow. These requests bypass the single-use guarantee on authorization codes and produce multiple valid codes for the same authorization event.

Each generated code can then be exchanged independently for its own access and refresh token pair. Because refresh tokens persist independently of the application's authorization status, the attacker retains valid credentials even after the user revokes the OAuth application. This effectively bypasses the de-authorization control intended to terminate third-party access.

Root Cause

The root cause is improper synchronization and validation around authorization code issuance and consumption. Sentry's pre-25.5.0 code path did not atomically enforce single-use semantics on authorization codes or correctly tie refresh token validity to the application's authorization state. The fix landed in commits 57f0129, ab5fd93, and e624125, referenced in GitHub Pull Request #85570 and GitHub Pull Request #85571.

Attack Vector

Exploitation requires the attacker to register a malicious OAuth application with the target Sentry instance and convince a user to authorize it. User interaction is required to complete the initial OAuth consent. Once consent is granted, the attacker races multiple code exchange requests through the redirect endpoint to mint duplicate authorization codes, then exchanges each for a long-lived refresh token. The vulnerability is fully described in the GitHub Security Advisory GHSA-mgh8-h4xc-pfmj.

Detection Methods for CVE-2025-53099

Indicators of Compromise

Multiple successful /oauth/token exchanges referencing the same client_id and user within a narrow time window
OAuth refresh token usage from a client_id that the user has previously de-authorized
Unexpected new OAuth applications registered against organization or user accounts
API activity from OAuth tokens tied to applications no longer listed in the user's authorized apps

Detection Strategies

Audit Sentry application logs for concurrent authorization code redemptions originating from the same authorization event
Correlate OAuth de-authorization events with subsequent token usage to identify orphaned refresh tokens
Inventory all registered OAuth applications and flag those created by external or unverified developers

Monitoring Recommendations

Forward Sentry audit and OAuth logs to a centralized SIEM for retention and correlation
Alert on refresh token grants that occur after an application revocation event for the same user
Track creation of new OAuth applications and require approval workflows for third-party integrations

How to Mitigate CVE-2025-53099

Immediate Actions Required

Upgrade self-hosted Sentry deployments to version 25.5.0 or later without delay
Review the list of authorized OAuth applications for each user and organization and revoke any that are unrecognized
Rotate or invalidate existing OAuth tokens issued before the upgrade to clear any persisted attacker access
Audit recent OAuth application registrations and remove untrusted entries

Patch Information

The issue is patched in Sentry 25.5.0. The relevant changes are in commits 57f0129, ab5fd93, and e624125. Additional hardening landed in GitHub Pull Request #86069 and GitHub Pull Request #86532. Sentry SaaS users do not need to take any action.

Workarounds

Restrict OAuth application registration to trusted administrators until the upgrade is complete
Enforce mandatory review of OAuth consent prompts and user training to avoid authorizing unknown applications
Manually invalidate refresh tokens associated with previously de-authorized applications through database-level intervention if upgrade is delayed

bash

# Configuration example - upgrade self-hosted Sentry to 25.5.0 or later
git fetch --tags
git checkout 25.5.0
./install.sh