Authentication Bypass in Siemens Mendix SAML Module (CVE‑2026‑89209) Enables Unauthorized Access
What It Is — The Siemens Mendix SAML module (used with Mendix 9‑11) contains an authentication‑bypass flaw (CVE‑2026‑89209). The module fails to protect against replay of a valid SAML assertion during IdP‑initiated authentication flows. An unauthenticated remote attacker can capture a legitimate SAML response and replay it to gain unauthorized access to any application that relies on the vulnerable module. The vulnerability is rated CVSS v3 6.8 (High) and is listed in a CISA advisory for critical manufacturing and IT sectors. Siemens has released patched versions (≥ 4.2.4 for Mendix 10/11, ≥ 3.6.29 for Mendix 9) and recommends immediate upgrade or disabling IdP‑initiated flows as a mitigation.
Affected Products — Siemens Mendix SAML module (Mendix 9, 10, 11 compatible) versions prior to 3.6.29 / 4.2.4.
Why It Matters for Trust & Control Assurance — The flaw directly challenges the control objective of robust authentication and session management; confirming that assertions cannot be replayed is essential for audit‑ready identity assurance.
Recommended Actions —
- Upgrade to the patched Mendix SAML module versions (≥ 3.6.29 for Mendix 9, ≥ 4.2.4 for Mendix 10/11).
- If immediate upgrade is not possible, disable IdP‑initiated authentication flows and enforce strict assertion timestamps.
- Enable detailed logging of SAML authentication events and monitor for replay attempts.
Source: CISA Advisory