Skip to content
NewA calmer, faster ZeroHour
StoryAdvisoryhigh

Mendix SAML modules allow IdP assertion replay

2 sources · 2 articlesFirst reported Updated ()1
What's new

No newer facts. The latest item remains CISA’s October 29 republication of SSA-137528 with CVE-2026-89209.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Mendix SAML modules before the fixed builds can be bypassed by replaying a valid IdP response; updates are available.

Canada’s Cyber Centre on October 26, 2026, and CISA on October 29 republished Siemens ProductCERT advisory SSA-137528. The Mendix SAML module does not properly block replay of SAML assertions during IdP-initiated authentication, so an unauthenticated remote attacker who replays a valid SAML response could gain unauthorized application access. Affected builds are Mendix 9-compatible modules before V3.6.29 and Mendix 10- and 11-compatible modules before V4.2.4. Siemens advises updating or disabling IdP-initiated SSO. CISA assigns CVE-2026-89209, CWE-294, and CVSS 6.8 medium; exploitation is not discussed.

Key facts
  • Canada issued AV26-1083 on October 26, 2026, citing Siemens ProductCERT.
  • Mendix 9 modules before V3.6.29 are affected; fix is V3.6.29 or later.
  • Mendix 10 and 11 modules before V4.2.4 are affected; fix is V4.2.4 or later.
  • CISA lists CVE-2026-89209, CWE-294, and CVSS 6.8 medium.
  • Siemens also advises disabling IdP-initiated SSO if updates are not applied.
  • Neither notice discusses whether the flaw is being exploited.
Analyze CVE-2026-89209 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 26, 2026Canada republished Siemens SSA-137528 as AV26-1083. · Canadian Centre for Cyber Security
  2. Oct 29, 2026CISA republished Siemens ProductCERT advisory SSA-137528. · CISA Advisories

What each outlet adds

beyond the shared facts
  • Canadian Centre for Cyber SecurityAssigns Canadian serial AV26-1083 and the October 26 circulation date.
  • CISA AdvisoriesAdds CVE-2026-89209, CWE-294, CVSS 6.8, and the SSO workaround.
CVEs
CVE-2026-89209
Vendors
Siemens
Products
Mendix SAML
Organizations
Canadian Centre for Cyber SecurityCISASiemens ProductCERT

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Canadian Centre for Cyber SecurityFirst report

    Siemens Mendix SAML module has an authentication-bypass flaw

    Mendix 9 builds before V3.6.29 and Mendix 10 and 11 builds before V4.2.4 are affected; Canada urges administrators to apply updates.

  2. · 1d ago CISA Advisories

    Siemens Mendix SAML module allows assertion-replay login bypass

    Unauthenticated attackers can replay a valid IdP-initiated SAML response; fixes are V4.2.4 and V3.6.29.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-89209
SAML assertion replay in Mendix SAML IdP-initiated login
7.6—