Log in Start free

Vulnerability · Published Oct 26, 2026 · Assigned by siemens

CVE-2026-89209

Medium 6.8

In plain English

A medium-severity security flaw in Mendix SAML (Mendix 10 compatible) from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

Affected products (as reported)

VendorProductVersions
Siemens Mendix SAML (Mendix 10 compatible) 0 – before V4.2.4
Siemens Mendix SAML (Mendix 11 compatible) 0 – before V4.2.4
Siemens Mendix SAML (Mendix 9 compatible) 0 – before V3.6.29

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References