CVE-2026-89209: high-severity vulnerability in Siemens Mendix SAML (Mendix 10 compatible)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6epss 0.3%
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected products
Siemens · Mendix SAML (Mendix 10 compatible)Siemens · Mendix SAML (Mendix 11 compatible)Siemens · Mendix SAML (Mendix 9 compatible)Related CVEs — Siemens Mendix SAML (Mendix 10 compatible)
In the same product, most dangerous first.