Siemens Mendix SAML Module Authentication Bypass Vulnerability

Siemens ProductCERT reported a vulnerability in the Mendix SAML module that could allow an unauthenticated remote attacker to gain unauthorized access. The issue affects the Mendix SAML module across three compatible lines: Mendix 10 compatible versions earlier than 4.2.4, Mendix 11 compatible versions earlier than 4.2.4, and Mendix 9 compatible versions earlier than 3.6.29. All affected versions are tracked under CVE-2026-89209.

The vulnerability arises from the module's improper protection against SAML assertion replay in IdP-initiated authentication flows. An attacker situated remotely and unauthenticated could replay a valid SAML response to bypass authentication controls and access the application without valid credentials.

Siemens has released updated versions of the module to address the flaw. The vendor recommends that users update to Mendix SAML Module version 4.2.4 or later for Mendix 10 and 11 compatible versions, or version 3.6.29 or later for Mendix 9 compatible versions. As a temporary mitigation, Siemens and CISA recommend disabling IdP-initiated SSO until the update can be applied.

CISA has published the advisory (ICSA-26-302-01) and recommends that organizations minimize network exposure for control system devices, ensure they are not accessible from the internet, and locate control system networks behind firewalls isolating them from business networks. When remote access is required, the use of VPNs is advised, with the recognition that VPNs should be updated to the most current version available. CISA also emphasizes performing a proper impact analysis and risk assessment prior to deploying any defensive measures.