SAML Assertion Replay Vulnerability in Mendix Products
CVE-2026-89209

7.6HIGH

Key Information:

Vendor

Siemens
Status
Mendix Saml (mendix 10 Compatible)
Mendix Saml (mendix 11 Compatible)
Mendix Saml (mendix 9 Compatible)
Vendor
CVE Published:
26 October 2026

What is CVE-2026-89209?

A weakness has been detected in the Mendix SAML module, affecting multiple versions across different Mendix platforms. This vulnerability stems from insufficient protections against SAML assertion replay in IdP-initiated authentication flows. Attackers could exploit this flaw, enabling them to replay valid SAML assertions and gain unauthorized access to applications, thus compromising sensitive data and systems.

Affected Version(s)

Mendix SAML (Mendix 10 compatible) 0

Mendix SAML (Mendix 11 compatible) 0

Mendix SAML (Mendix 9 compatible) 0

References

https://cert-portal.siemens.com/productcert/html/ssa-1375...

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.