EUVD-2026-70411
GHSA-249p-r5w7-w969
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable ACS endpoint (AV:N), specific SSO configuration prerequisite (AC:H), no attacker privileges needed (PR:N), victim must participate in SSO flow (UI:R), scope change to application resources via session hijack (S:C), full confidentiality and integrity impact (C:H/I:H), no availability impact.
Primary rating from Vendor (siemens).
CVSS VectorVendor: siemens
Lifecycle Timeline
7DescriptionCVE.org
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.
AnalysisAI
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target Mendix application must have the SAML module installed with SSO enabled in one of the 'specific SSO configurations' identified as vulnerable - not all SAML deployments are affected, and the exact configuration prerequisites are not enumerated in available public data (consult SSA-887643); (2) an unauthenticated remote attacker must be able to submit a crafted SAML response to the application's Assertion Consumer Service endpoint over the network; (3) a legitimate user must be actively participating in or have recently initiated an SSO authentication exchange (UI:P per CVSS 4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.8 correctly reflects high confidentiality and integrity impact but is meaningfully tempered by AC:H (high complexity) and AT:P (specific attack prerequisites tied to SSO configuration). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Mendix SAML module to V4.2.3 or later for Mendix 10 and 11 compatible deployments, or to V3.6.27 or later for Mendix 9.24 compatible deployments; both fix versions are confirmed by Siemens advisory SSA-887643 (https://cert-portal.siemens.com/productcert/html/ssa-887643.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Mendix deployments using versions 9.24, 10, or 11 with SAML authentication enabled and assess current version baseline. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today