EUVD-2026-109739
GHSA-c6gm-hvjc-mr8p
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Replay attack prevention
|
| Impact | The input CVSS 4.0 vector (7.6, High) describes a network-reachable (AV:N), unauthenticated (PR:N) authentication bypass, but two metrics materially lower real-world ease: AC:H (the attacker must obtain a valid, unexpired SAML response to replay) and UI:P (a legitimate user's IdP-initiated authentication must occur to produce that response). No EPSS score, KEV listing, SSVC automatable/technical-impact breakdown, or PoC reference is present in the supplied data, so exploitation probability and automatability cannot be quantified from the input. The only priority signal is the vuln.today Decision label 'this_week' - not act_now or emergency - which aligns with a serious but non-emergency authentication flaw that requires capturing live traffic rather than a trivially mass-exploitable bug. Net assessment: a genuine access-control weakness worth patching on the vendor's this_week cadence, but its practical exploitation hinges on the attacker first capturing a valid assertion, so it is not an indiscriminate internet-wide threat on the evidence available. EPSS and SSVC exploitation data are missing and should be checked before final prioritization. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 26, 2026
Mendix SAML modules for Mendix 9, 10 and 11 fail to block replay of SAML assertions in IdP-initiated authentication flows, allowing an unauthenticated remote attacker to gain unauthorized application access by re-presenting a valid SAML response. Three module branches are affected: the Mendix 10 and Mendix 11 compatible modules below V4.2.4 and the Mendix 9 compatible module below V3.6.29. Per the assessed CVSS 4.0 vector (7.6, High), the attack is network-reachable and requires no credentials (PR:N), but difficulty is raised by AC:H (the attacker must first obtain a valid, unexpired SAML response) and UI:P (a legitimate user's IdP-initiated authentication must occur to produce that response); no public exploit was identified at time of analysis and no KEV entry exists.
RemediationAI
Vendor-released patch: upgrade Mendix SAML (Mendix 10 compatible) and Mendix SAML (Mendix 11 compatible) to V4.2.4 or later, and Mendix SAML (Mendix 9 compatible) to V3.6.29 or later, as documented in Siemens advisory SSA-137528 (https://cert-portal.siemens.com/productcert/html/ssa-137528.html). The fix applies to the SAML module itself, so Mendix application deployments must update the module dependency and redeploy rather than upgrade only the runtime. Prioritization should account for the assessed preconditions: exploitation requires capture of a valid, unexpired SAML response from a legitimate IdP-initiated login (AC:H, UI:P) and no public exploit was identified at time of analysis, placing this in the current-week remediation queue rather than an emergency patching tier.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected components are Siemens' Mendix SAML single-sign-on modules, which implement the SAML 2.0 service-provider role for Mendix applications and accept assertions delivered through IdP-initiated (unsolicited) flows. The flaw is CWE-294, Authentication Bypass by Capture-replay: the module does not adequately enforce one-time use of assertions in IdP-initiated flows - for example, tracking previously consumed assertion IDs within their validity window - so a captured SAML response can be submitted again and accepted as a fresh authentication. Because the replayed response is a genuine, signed assertion already trusted by the SP, no credential guessing or signature forgery is required; the practical constraint is acquisition of a valid response (AC:H) and the dependency on a legitimate user actually authenticating through the IdP to generate one (UI:P). Impact is scoped to the Mendix application (VC:H/VI:H, no subsequent-system impact), i.e., session hijacking into the target application as the victim user. The trigger specifics beyond the replay of a valid SAML response are not described in the available sources.
Know when Mendix Saml Mendix 10 Compatible gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (siemens) · only source for this CVE.
CVSS VectorVendor: siemens
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
Executive ViewAI
CVE-2026-89209 is a high-severity flaw in Mendix SAML modules that permits unauthenticated attackers to replay captured SAML assertions, bypassing authentication to gain unauthorized access to applications built on Mendix 9, 10, and 11. This affects all Mendix deployments using the vulnerable SAML module branches, potentially exposing sensitive business data and operations. Leadership should prioritize remediation because exploitability requires only a valid, unexpired SAML response, and no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce network segmentation and access restrictions to Mendix applications, enable multi-factor authentication at the identity provider, monitor for replay attempts using SAML assertion ID tracking, reduce SAML assertion validity periods, and consider temporarily disabling IdP-initiated flows if operationally viable.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB