CVE-2025-53099

Sentry Missing Invalidation of Authorization Codes During OAuth Exchange and Revocation

Sentry is a developer-first error tracking and performance monitoring tool. Prior to version 25.5.0, an attacker with a malicious OAuth application registered with Sentry can take advantage of a race condition and improper handling of authorization code within Sentry to maintain persistence to a user's account. With a specially timed requests and redirect flows, an attacker could generate multiple authorization codes that could be used to exchange for access and refresh tokens. This was possible even after de-authorizing the particular application. This issue has been patched in version 25.5.0. Self-hosted Sentry users should upgrade to version 25.5.0 or higher. Sentry SaaS users do not need to take any action.

We have discovered 62 live websites that are affected by CVE-2025-53099.

Run a Free Instant Scan



Affected Software

Product  Sentry Server
Category Error and Exception Monitoring
Vulnerable Domains62 live websites (100% of Sentry Server install base)
Vulnerable Versions
  • from 0 through 25.5
Vulnerable Versions Count0 versions ( less than 0.1% of all versions)


Common Weakness Enumeration

CWE-288 Authentication Bypass Using an Alternate Path or Channel



Details

  • Published - Jul 1, 2025
  • Updated - Jul 1, 2025

Website Distribution by Country

Number of websites using CVE-2025-53099
United States19 websites


Germany11 websites
France10 websites
Iran3 websites
Russia3 websites
Australia2 websites
Switzerland2 websites
China2 websites
GB2 websites
Hungary2 websites

Website Distribution by TLD

Number of websites using CVE-2025-53099
.com23 websites
.it5 websites
.de4 websites
.co2 websites
.com.au2 websites
.ru2 websites
.ch1 websites
.cn1 websites
.eu1 websites
.io1 websites

Websites affected by CVE-2025-53099

Top websites that are affected by CVE-2025-53099. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.********.eu Switzerland***,***
***.***********.com United States***,***
**************.*******.me Brazil*,***,***
********.com Germany*,***,***
******.******.com United States*,***,***
*****.com United States*,***,***
*******.****.ch Switzerland*,***,***
******.****.*.io GB*,***,***
******.****************.solutions United States*,***,***
******.****.com United States**,***,***
See full domain list

FAQ

CVE-2025-53099 is Authentication Bypass Using an Alternate Path or Channel in Sentry Server
A total of 62 websites have been identified as vulnerable to CVE-2025-53099, based on global website indexing conducted by WebTechSurvey.
The Sentry Server is affected by the CVE-2025-53099 vulnerability.
Sentry Server versions up to 25.5 are vulnerable to CVE-2025-53099.
CVE-2025-53099 is resolved in version 25.5 of Sentry Server.