CVE-2026-89209
Received Received - Intake

SAML Assertion Replay in Mendix SAML Module

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: siemens-SADP

Description
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-89209
EUVD
EUVD-2026-109739

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-294 A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in the Mendix SAML module. It allows unauthenticated remote attackers to gain unauthorized access by replaying a valid SAML assertion during IdP-initiated authentication flows. Affected versions include all releases before V3.6.29 for Mendix 9, and V4.2.4 for Mendix 10 and 11.

Detection Guidance

Monitor SAML authentication logs for repeated or unusual IdP-initiated authentication attempts. Check for multiple successful logins from the same SAML assertion within a short timeframe. Inspect network traffic for replayed SAML responses using tools like Wireshark or tcpdump to capture and analyze SAML assertions.

Impact Analysis

An attacker could exploit this to bypass authentication and gain unauthorized access to the application. This may lead to data breaches, unauthorized actions, or further compromise of the system. The impact severity is high due to the potential for full access without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access, potentially violating data protection requirements under GDPR and HIPAA. Compliance may be compromised if sensitive data is exposed or accessed without authorization.

Mitigation Strategies

Update the Mendix SAML module to the latest version (V3.6.29 or later for Mendix 9, V4.2.4 or later for Mendix 10 and 11). As a temporary measure, disable IdP-initiated SSO until the update is applied. Restrict network access to the SAML module and follow Siemens' operational security guidelines.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart