TI-2026-80330 Aliases CVE-2026-89209 GHSA-c6gm-hvjc-mr8p

Authentication bypass by SAML assertion replay in Siemens Mendix SAML

LOW 35CWE-294Published 2026-10-26 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: High
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-294.

Summary

Siemens Mendix SAML (Mendix 10 compatible) and Mendix SAML (Mendix 11 compatible) versions before V4.2.4, and Mendix SAML (Mendix 9 compatible) versions before V3.6.29, are affected. The module does not properly protect against SAML assertion replay in IdP-initiated authentication flows (CWE-294). An unauthenticated remote attacker can gain unauthorized access to the application by replaying a valid SAML response.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00259 17th percentileScored 2026-11-07

Fix Fixed Mendix SAML (Mendix 10 compatible) (Siemens): V4.2.4Mendix SAML (Mendix 11 compatible) (Siemens): V4.2.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	Mendix SAML (Mendix 10 compatible)	before V4.2.4	V4.2.4	Patch available	CNA
Siemens	Mendix SAML (Mendix 11 compatible)	before V4.2.4	V4.2.4	Patch available	CNA
Siemens	Mendix SAML (Mendix 9 compatible)	before V3.6.29	V3.6.29	Patch available	CNA

Mendix SAML (Mendix 10 compatible) VendorSiemens Affected before V4.2.4 Fixed in V4.2.4 Patch available CNA
Mendix SAML (Mendix 11 compatible) VendorSiemens Affected before V4.2.4 Fixed in V4.2.4 Patch available CNA
Mendix SAML (Mendix 9 compatible) VendorSiemens Affected before V3.6.29 Fixed in V3.6.29 Patch available CNA

Remediation

Update Mendix SAML (Mendix 10 compatible) and Mendix SAML (Mendix 11 compatible) to V4.2.4 and Mendix SAML (Mendix 9 compatible) to V3.6.29.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Fix · CNA Mendix SAML (Mendix 10 compatible) (Siemens) Fixed in V4.2.4
Fix · CNA Mendix SAML (Mendix 11 compatible) (Siemens) Fixed in V4.2.4
Fix · CNA Mendix SAML (Mendix 9 compatible) (Siemens) Fixed in V3.6.29

Timeline

2026-10-26 Threatist record created from CVE-2026-89209
2026-10-27 Alias added: GHSA-c6gm-hvjc-mr8p
2026-10-27 Priority changed: MEDIUM → LOW
2026-10-31 CISA SSVC decision points changed

References

Other 1

https://cert-portal.siemens.com/productcert/html/ssa-137528.html

TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0

See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences