Skip to content
NewA calmer, faster ZeroHour
Advisorymedium

Siemens Mendix SAML module allows assertion-replay login bypass

Original title: Siemens Mendix SAML Module

CISA Advisoriesby CISA ()3 min read1
Read at cisa.gov
Part of a story covered by 2 sourcesMendix SAML modules allow IdP assertion replayMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Unauthenticated attackers can replay a valid IdP-initiated SAML response; fixes are V4.2.4 and V3.6.29.

Siemens ProductCERT, republished by CISA, says the Mendix SAML module does not properly block replay of SAML assertions in IdP-initiated authentication. An unauthenticated remote attacker who replays a valid SAML response could gain unauthorized application access. Mendix 10- and 11-compatible builds before V4.2.4, and Mendix 9-compatible builds before V3.6.29, are affected. Siemens advises updating or disabling IdP-initiated SSO. CVSS is 6.8 medium, and exploitation is not discussed.

Key facts
  • The weakness is CWE-294, authentication bypass by capture-replay.
  • Mendix 10 and 11 modules should move to V4.2.4 or later.
  • The Mendix 9-compatible module should move to V3.6.29 or later.
  • CISA republished Siemens ProductCERT advisory SSA-137528.
Security assessment · AI, from the article

Impact: Unauthorized application access by replaying a SAML assertion

ProductAffectedFixed in
Siemens Mendix SAML (Mendix 10 compatible)before V4.2.4V4.2.4 or later
Siemens Mendix SAML (Mendix 11 compatible)before V4.2.4V4.2.4 or later
Siemens Mendix SAML (Mendix 9 compatible)before V3.6.29V3.6.29 or later
What to do
  1. 1.Update Mendix 10 and 11 SAML modules to V4.2.4 or later.
  2. 2.Update the Mendix 9 SAML module to V3.6.29 or later.
  3. 3.Disable IdP-initiated SSO where the update cannot be applied.
Analyze CVE-2026-89209 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-89209
ATT&CK
T1550 Use Alternate Authentication Material
Tags
siemensmendixsamlauthentication-bypassics
Vendors
Siemens
Products
Mendix SAML
Organizations
CISASiemens ProductCERT

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-89209
SAML assertion replay in Mendix SAML IdP-initiated login
7.6—

From the original article

3 min read at cisa.gov

View CSAF Summary Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.