Critical
CVSS 9.1 XSS Responsible Disclosure
Disclosure
Sentry DSN Exposure + Event Injection (Stored XSS via Error Events)
The self-hosted Sentry instance at apm.[vendor] leaks its DSN (Data Source Name) key in the login page's __initialData JavaScript object. This DSN allows any unauthenticated attacker to inject arbitrary error events, including crafted XSS payloads, into the Sentry dashboard. When an administrator views these injected events, the XSS
- Target
- NA Gift Card Supplier
- Category
- XSS
- Channel
- Responsible Disclosure
- Disclosed
- 2026-03
Redaction note
Vendor identity withheld.
This finding is documented here as part of MemCyber’s public disclosure record. The vendor has been anonymized to a sector and region descriptor. Full technical detail — including root cause, reproducible proof-of-concept, remediation guidance, and vendor attribution where granted — is available to qualified prospects under NDA.
Coordinated disclosure
How we handled it.
- Reported to the vendor via Responsible Disclosure with a reproducible proof-of-concept.
- Triage + remediation window coordinated with the vendor security team.
- Fix verified before any public reference.
- This record published only after the embargo period closed.