Government Advisory

Siemens Mendix SAML Module Flaw Could Let Attackers Replay Logins to Gain Access

CISA · 29 Oct 2026

Key Takeaway If your business runs Mendix applications with the SAML module for single sign-on, update to the latest fixed version (4.2.4 or later, or 3.6.29 or later for Mendix 9) as soon as possible.

CISA has published an advisory about an authentication bypass vulnerability (CVE-2026-89209) in the Siemens Mendix SAML module. The module is used for single sign-on in applications built on the Mendix platform. The flaw has a CVSS v3 score of 6.8.

According to the advisory, affected versions do not properly protect against SAML assertion replay in IdP-initiated authentication flows. An unauthenticated remote attacker could capture a valid SAML response and replay it to gain unauthorised access to the application.

The affected versions are Mendix SAML for Mendix 10 and Mendix 11 below version 4.2.4, and Mendix SAML for Mendix 9 below version 3.6.29. Siemens has released new versions and recommends updating to the latest release.

Siemens Mendix SAML Authentication Bypass CISA Advisory

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.