CVE-2026-89209: Medium severity Mendix Mendix SAML (Mendix 10 compatible) vulnerability
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mendix SAML (Mendix 10 compatible)to a version that resolves this vulnerability.Fixed in V4.2.4 - Upgrade
Upgrade
Mendix SAML (Mendix 11 compatible)to a version that resolves this vulnerability.Fixed in V4.2.4 - Upgrade
Upgrade
Mendix SAML (Mendix 9 compatible)to a version that resolves this vulnerability.Fixed in V3.6.29
Event History
Frequently Asked Questions
What must an attacker obtain to exploit this issue?
An attacker needs a valid SAML response that can be replayed. Exploitation applies to IdP-initiated authentication flows and can be performed remotely without prior authentication, although user interaction is required according to the supplied vector.
Which deployments are affected?
Mendix SAML modules compatible with Mendix 10 or Mendix 11 are affected before version 4.2.4. The Mendix 9-compatible module is affected before version 3.6.29.
What is the impact of successful exploitation?
A remote attacker could gain unauthorized access to the application by replaying a valid SAML assertion. The provided severity vector indicates high confidentiality and integrity impact, with no availability impact.