CVE-2026-80465: Mendix SAML cryptographic signature validation bypass

CVE-2026-80465 · Severity: high · CVSS 8.7 · Published 2026-09-03

Mendix SAML, an authentication module used to enable single sign-on (SSO) in Mendix applications, contains a flaw in its signature verification logic. An unauthenticated attacker can exploit this to forge or bypass SAML authentication responses in certain SSO configurations, allowing them to hijack user accounts and gain unauthorized access to applications without valid credentials.

Vendors: Siemens.

Quick answers

Is CVE-2026-80465 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-80465 being exploited in the wild.
How severe is CVE-2026-80465?
High severity, with a CVSS score of 8.7, published 3 September 2026.
Which products and versions are affected?
Siemens Mendix SAML (Mendix 10 compatible) All versions < 4.2.3; Siemens Mendix SAML (Mendix 11 compatible) All versions < 4.2.3; Siemens Mendix SAML (Mendix 9.24 compatible) All versions < 3.6.27.
Is there a fix for CVE-2026-80465?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80465 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-80465?
Check whether you run Siemens Mendix SAML (Mendix 10 compatible), Siemens Mendix SAML (Mendix 11 compatible) or Siemens Mendix SAML (Mendix 9.24 compatible) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mendix SAML module fails to properly validate the cryptographic signature on SAML authentication responses, a violation of the SAML specification (CWE-347). An unauthenticated remote attacker can craft a malicious SAML response with invalid or absent signatures that the module will accept, leading to arbitrary account hijacking in specific SSO deployments. The vulnerability requires specific SSO configuration and user interaction but no prior authentication. Patches are available: update Mendix SAML (Mendix 9.24 compatible) to v3.6.27+, Mendix SAML (Mendix 10 compatible) to v4.2.3+, or Mendix SAML (Mendix 11 compatible) to v4.2.3+.

Affected products

  • Siemens Mendix SAML (Mendix 9.24 compatible) All versions < 3.6.27
  • Siemens Mendix SAML (Mendix 10 compatible) All versions < 4.2.3
  • Siemens Mendix SAML (Mendix 11 compatible) All versions < 4.2.3

Timeline

  • 2026-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.