Siemens Mendix SAML Module Vulnerability Allows Account Hijacking via SAML Signature Bypass

A critical vulnerability in the Siemens Mendix SAML module has been disclosed, affecting versions of the module that fail to properly validate SAML response signatures. Designated CVE-2026-80465, the flaw carries a CVSS 3.1 base score of 8.7 and is classified as HIGH severity.

The vulnerability arises from improper verification of cryptographic signatures. In specific Single Sign-On (SSO) configurations, unauthenticated remote attackers could exploit this weakness to hijack user accounts or sessions. The issue impacts three version families: Mendix SAML (Mendix 10 compatible) below V4.2.3, Mendix SAML (Mendix 11 compatible) below V4.2.3, and Mendix SAML (Mendix 9.24 compatible) below V3.6.27.

Siemens ProductCERT identified and reported the vulnerability to CISA. Vendor fixes have been released; Mendix has published updated versions of the SAML module through its marketplace. Siemens advises operators to update to V4.2.3 or later (for Mendix 10/11 compatible) or V3.6.27 or later (for Mendix 9.24 compatible) to remediate the issue.

As a defensive measure, Siemens and CISA recommend minimizing network exposure for affected devices, ensuring they are not accessible from the internet, and locating control system networks behind firewalls isolated from business networks. When remote access is required, the use of updated Virtual Private Networks (VPNs) is advised. Organizations should perform impact analysis and risk assessment before deploying defensive measures.