Siemens Mendix SAML Module Vulnerable to Authentication Bypass
Siemens Mendix SAML module contains an authentication bypass vulnerability (CVE-2026-89209) that could allow unauthenticated remote attackers to gain unauthorized access.
Siemens has released security advisories detailing a critical authentication bypass vulnerability affecting its Mendix SAML module. The flaw, identified as CVE-2026-89209, could permit unauthenticated remote attackers to gain unauthorized access to applications by replaying a valid SAML assertion during Identity Provider (IdP)-initiated authentication flows.
The vulnerability stems from an insufficient protection mechanism against SAML assertion replay attacks. This allows attackers to capture a legitimate SAML response and reuse it to authenticate themselves as a legitimate user. The exploit is particularly concerning as it targets IdP-initiated flows, which are commonly used in single sign-on (SSO) implementations.
Multiple versions of the Mendix SAML module are impacted. Specifically, versions prior to 4.2.4 for Mendix 10 and Mendix 11 compatible modules, and versions prior to 3.6.29 for Mendix 9 compatible modules, are known to be affected. The Common Vulnerability Scoring System (CVSS) v3.1 base score for this vulnerability is 6.8 (MEDIUM), with a vector string indicating a network attack vector, high complexity, no privileges required, user interaction required, and a scope of unchanged, leading to high confidentiality and integrity impact, but no availability impact.
Siemens has addressed this vulnerability by releasing updated versions of the affected Mendix SAML modules. Users are strongly advised to update to the latest versions to mitigate the risk. For Mendix 10 and 11 compatible modules, the fix is available in version 4.2.4 or later. For Mendix 9 compatible modules, users should update to version 3.6.29 or later.
As a mitigation strategy, organizations that cannot immediately update can disable IdP-initiated SSO functionality within their Mendix SAML configurations. This measure can help prevent exploitation of the authentication bypass vulnerability while a permanent fix is being applied.
Siemens also provides general security recommendations for its products, emphasizing the importance of protecting network access to devices and configuring IT environments according to their operational guidelines for Industrial Security. These guidelines, along with product manuals, offer best practices for securing industrial control systems and connected devices.
CISA has republished the advisory to increase visibility and urges organizations to implement defensive measures to minimize the risk of exploitation. These measures include minimizing network exposure for control system devices, isolating them from business networks via firewalls, and using secure remote access methods like VPNs, ensuring VPNs are also kept updated.
This advisory was originally reported to CISA by Siemens ProductCERT, highlighting the collaborative efforts between vendors and security agencies in identifying and disseminating critical vulnerability information to protect industrial and IT infrastructure worldwide.