CVE-2025-40758: High severity Mendix SAML (Mendix 10.12 compatible) vulnerability
A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-40758?
The severity of CVE-2025-40758 has not been explicitly categorized, but it poses significant security risks due to insufficient enforcement of signature validation.
How do I fix CVE-2025-40758?
To fix CVE-2025-40758, upgrade Mendix SAML to version 4.0.3 or later for Mendix 10.12, version 4.1.2 or later for Mendix 10.21, or version 3.6.21 or later for Mendix 9.24.
What are the affected versions in CVE-2025-40758?
CVE-2025-40758 affects Mendix SAML versions prior to 4.0.3 for Mendix 10.12, prior to 4.1.2 for Mendix 10.21, and prior to 3.6.21 for Mendix 9.24.
What kind of attacks can exploit CVE-2025-40758?
CVE-2025-40758 could potentially allow attackers to bypass security mechanisms, leading to unauthorized access or data disclosure.
Is there a workaround for CVE-2025-40758 if I cannot upgrade immediately?
Currently, there are no documented workarounds for CVE-2025-40758, and it is recommended to apply the upgrade as soon as possible.