View CSAF

Summary

Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.

The following versions of Siemens Mendix SAML Module are affected:

Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.4 (CVE-2026-89209)

Mendix SAML (Mendix 11 compatible) vers:intdot/<4.2.4 (CVE-2026-89209)

Mendix SAML (Mendix 9 compatible) vers:intdot/<3.6.29 (CVE-2026-89209)

CVSS Vendor Equipment

v3 6.8 Siemens Mendix SAML (Mendix 10 compatible)

1 Vulnerability

Authentication Bypass by Capture-replay

Background

Critical Infrastructure Sectors: Critical Manufacturing, Information Technology

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Germany

Vulnerabilities

CVE-2026-89209

Affected versions of the module do not properly…