{"id":"CVE-2026-89209","title":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29)","summary":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions …","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-294"],"vendor":"Siemens","product":"Mendix SAML (Mendix 10 compatible)","affected":["mendix_saml_mendix_10_compatible < V4.2.4","mendix_saml_mendix_11_compatible < V4.2.4","mendix_saml_mendix_9_compatible < V3.6.29"],"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T10:41:01.088Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89209","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-137528.html"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T11:24:53.910Z","slug":"CVE-2026-89209","body":"## Overview\n\nA vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.\n\n## Affected\n\n- `mendix_saml_mendix_10_compatible < V4.2.4`\n- `mendix_saml_mendix_11_compatible < V4.2.4`\n- `mendix_saml_mendix_9_compatible < V3.6.29`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}