CVE-2026-80465
Received Received - Intake

SAML Signature Validation Bypass in Mendix

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: siemens-SADP

Description
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-80465
EUVD
EUVD-2026-70411

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
mendix mendix_saml to 4.2.3 (exc)
mendix mendix_saml to 3.6.27 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Mendix SAML module used for Single Sign-On (SSO) authentication. It allows unauthenticated remote attackers to hijack user accounts by exploiting improper validation of SAML response signatures in specific SSO configurations.

Impact Analysis

An attacker could gain unauthorized access to user accounts, potentially leading to data breaches, unauthorized actions, or session hijacking in systems using affected Mendix SAML versions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Update the Mendix SAML module to the latest fixed versions: V3.6.27 or later for Mendix 9.24, and V4.2.3 or later for Mendix 10 and 11. Protect network access to devices and follow operational guidelines for Industrial Security.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart