CVE-2026-89209 Details
Description
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
An authentication bypass vulnerability has been identified in the Mendix SAML module, specifically in versions prior to 4.2.4 for Mendix 10 and 11, and versions prior to 3.6.29 for Mendix 9. The vulnerability arises because the affected versions do not adequately protect against the replay of SAML assertions in Identity Provider (IdP)-initiated authentication flows. This flaw could enable unauthenticated remote attackers to gain unauthorized access to applications by replaying valid SAML responses.
Users are advised to update to Mendix SAML version 4.2.4 or later for Mendix 10 and 11 compatibility, or to version 3.6.29 or later for Mendix 9 compatibility. Specific update instructions can be found on the Mendix Marketplace.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Oct 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert-portal.siemens.com/productcert/html/ssa-137528.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Siemens Mendix SAML | < V3.6.29 < V4.2.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 31, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |