UpHeron
All vulnerabilities

Servers and applications

CVE-2023-39531

Incorrect credential validation on OAuth token requests

Severity
Medium 6.8
Published
9 Aug 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
23.7.2
Also known as
GHSA-hgj4-h2x3-rfx4
Sources
NVD, Project advisories (GitHub)

Description

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 23.7.2, an attacker with sufficient client-side exploits could retrieve a valid access token for another user during the OAuth token exchange due to incorrect credential validation. The client ID must be known and the API application must have already been authorized on the targeted…

Affected software

SoftwareAffected versions
SentryServers and applications · cpe:a:sentry:sentry
  • From 10.0.0 before 23.7.2
SentryServers and applications · github:getsentry/sentry
  • From 10.0.0 before 23.7.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-39531
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-39531
  • GitHub Advisory Database https://github.com/advisories/GHSA-hgj4-h2x3-rfx4
  • github.com https://github.com/getsentry/sentry/security/advisories/GHSA-hgj4-h2x3-rfx4