# CVE-2026-89209: Mendix SAML authentication bypass in IdP-initiated SSO

Source: https://junglewise.ai/threats/cve-2026-89209-a-vulnerability-has-been-identified-in-mendix-saml-mendix-10  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-89209 · Severity: high · CVSS 6.8 · Published 2026-10-26

Mendix SAML is a module that enables user authentication in cloud applications through SAML identity providers. The vulnerability allows unauthenticated attackers to replay captured SAML responses to gain unauthorized access to applications using IdP-initiated single sign-on flows, potentially leading to account takeover and unauthorized access to sensitive data.

Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-89209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89209 being exploited in the wild.

**How severe is CVE-2026-89209?** High severity, with a CVSS score of 6.8, published 26 October 2026.

**Which products and versions are affected?** Siemens Mendix SAML (Mendix 10 compatible) All versions < V4.2.4; Siemens Mendix SAML (Mendix 11 compatible) All versions < V4.2.4; Siemens Mendix SAML (Mendix 9 compatible) All versions < V3.6.29.

**Is there a fix for CVE-2026-89209?** Yes: fixed in Mendix SAML (Mendix 9 compatible) V3.6.29 or later; Mendix SAML (Mendix 10 compatible) V4.2.4 or later; Mendix SAML (Mendix 11 compatible) V4.2.4 or later. Until then: Disable IdP-initiated SSO to eliminate the attack vector until patching is possible. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-89209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-89209?** Check whether you run Siemens Mendix SAML (Mendix 10 compatible), Siemens Mendix SAML (Mendix 11 compatible) or Siemens Mendix SAML (Mendix 9 compatible) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Mendix SAML (Mendix 9 compatible) V3.6.29 or later; Mendix SAML (Mendix 10 compatible) V4.2.4 or later; Mendix SAML (Mendix 11 compatible) V4.2.4 or later

Disable IdP-initiated SSO to eliminate the attack vector until patching is possible.

## Technical details

The vulnerability is a SAML assertion replay attack (CWE-294) in IdP-initiated authentication flows. Affected versions do not properly validate replay protection on SAML responses, allowing an attacker with network access to capture and reuse a valid SAML assertion for authentication. This requires user interaction (a legitimate login) to capture an assertion, but grants unauthenticated access thereafter.

## Affected products

- Siemens Mendix SAML (Mendix 9 compatible) All versions < V3.6.29
- Siemens Mendix SAML (Mendix 10 compatible) All versions < V4.2.4
- Siemens Mendix SAML (Mendix 11 compatible) All versions < V4.2.4

## Timeline

- 2026-10-26: disclosed: Siemens ProductCERT advisory SSA-137528 published

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-137528.html](https://cert-portal.siemens.com/productcert/html/ssa-137528.html)

## Related threats

- [Mendix SAML cryptographic signature validation bypass](https://junglewise.ai/threats/cve-2026-80465-mendix-saml-cryptographic-signature-validation-bypass)