CVE-2026-89209

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

Score
CVSS 4.0 7.6 High
Status
Deferred - productcert@siemens.com
Published
2026-10-26
Last modified
2026-10-26
Weaknesses
CWE-294

Affected products

References

 
 
© AVABIS GmbH privacypolicy about