---
id: CVE-2026-89209
title: >-
  A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All
  versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions <
  V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29)
summary: >-
  A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All
  versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions <
  V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected
  versions …
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-294
vendor: Siemens
product: Mendix SAML (Mendix 10 compatible)
affected:
  - mendix_saml_mendix_10_compatible < V4.2.4
  - mendix_saml_mendix_11_compatible < V4.2.4
  - mendix_saml_mendix_9_compatible < V3.6.29
published: '2026-10-26'
updated: '2026-10-26'
sourceUpdated: '2026-10-26T10:41:01.088Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89209'
references:
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-137528.html'
tags:
  - cve.org
ingestedAt: '2026-10-26T11:24:53.910Z'
---

## Overview

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

## Affected

- `mendix_saml_mendix_10_compatible < V4.2.4`
- `mendix_saml_mendix_11_compatible < V4.2.4`
- `mendix_saml_mendix_9_compatible < V3.6.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.