CVE-2026-89209

HIGH 7.6

Published 2026-10-26 · Last modified 2026-10-26

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

ELEVATED IMPACT

Severe if exploited (CVSS 7.6), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

—EPSS not yet scored

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

7.6CVSS 4.0 · HIGH

ConfidentialityHigh
IntegrityHigh
AvailabilityNone

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
⚠User interaction: Succeeds with passive user activity
⚠Complexity: Needs a race window or specific setup
✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot: 2026-10-26T13:52:32.101Z

Affected

Vendors Siemens

Products Mendix Saml (Mendix 10 Compatible) Mendix Saml (Mendix 11 Compatible) Mendix Saml (Mendix 9 Compatible)

Weakness (CWE)

CWE-294: : Authentication Bypass by Capture-replay

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References and research data (JSON)

All CVSS metrics

MEDIUM 6.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
HIGH 7.6 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

Advisories

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-109739 ADVISORYEUVD · EUVD-2026-109739

Technical & other

https://cert-portal.siemens.com/productcert/html/ssa-137528.htmlCVE record · siemens · Updated 2026-10-26T10:41:01.088Z

Sources: NVD · CVE.org · EPSS