Mendix SAML Vulnerability CVE-2026-89209: Replayed Logins Can Get Past SSO, Update to 4.2.4 or 3.6.29

Siemens has fixed a flaw in the Mendix SAML module, the add-on that many Mendix apps use for single sign-on. It could let an attacker reuse a valid sign-in response to get into an app as someone else. If your company runs internal or customer-facing apps built on Mendix and people sign in through an identity provider, check the module version this week. The fix is V4.2.4 for Mendix 10 and 11 apps and V3.6.29 for Mendix 9 apps.

What happened with the Mendix SAML vulnerability

On Monday, October 26, 2026, Siemens ProductCERT published advisory SSA-137528 for CVE-2026-89209. CISA republished it on Thursday, October 29, 2026 as ICSA-26-302-01.

Siemens says affected versions "do not properly protect against SAML assertion replay in IdP-initiated authentication flows." In plain terms: when your identity provider signs someone in, it gives the app a signed message that says this person has proven who they are. The app should accept that message once. Affected versions can accept it again, so an attacker holding a copy of a valid response could replay it and get in as that user.

What is confirmed and what is not known

Confirmed by Siemens and CISA:

• The flaw affects only IdP-initiated sign-in. That is when users start at the identity provider (for example, by clicking an app tile in a portal) rather than at the app's own login page.
• An unauthenticated remote attacker could replay a valid SAML response to get unauthorized access to the application.
• The only workaround Siemens lists for this flaw is to disable IdP-initiated SSO.
• CISA lists the affected sectors as Critical Manufacturing and Information Technology, deployed worldwide.

Not known or not stated:

• Neither advisory says the flaw has been used in attacks.
• Neither advisory explains how an attacker would get a valid SAML response in the first place. The score's "high attack complexity" and "user interaction required" ratings suggest the attacker needs a real user's sign-in to work with. No specific method is described.
• Siemens credits no outside researcher, and neither advisory mentions public exploit code.

The same update finishes an earlier Mendix SAML fix

This is the second Mendix SAML advisory in two months, and the two are linked. On Thursday, September 3, 2026, Siemens published SSA-887643 for CVE-2026-80465. That flaw (CWE-347, CVSS 3.1 score 8.7) is described as: affected versions "do not properly validate the SAML response signature." Siemens says this could let an unauthenticated attacker hijack an account in specific SSO configurations.

On October 26, Siemens revised that advisory with this note: "Released new fixed versions, as the previous versions did not fully remediate the vulnerability." The new fixed versions are the same as above: V4.2.4 for Mendix 10 and 11, and V3.6.29 for the Mendix 9.24 compatible module.

So if your team updated the SAML module in September and considered it done, it is not done. That is the gap we wrote about in Updated Is Not the Same as Patched.

Replay protection in IdP-initiated sign-in has caused trouble in this module before. The CVE record for CVE-2022-44457 describes an incomplete fix for an earlier flaw, CVE-2022-37011, in the module for Mendix 7, 8 and 9. In that case the problem appeared only when the non-default, discouraged "Allow Idp Initiated Authentication" option was turned on.

Why this matters for a business running Mendix apps

Mendix is a low-code platform, and companies use it to build work order systems, approval workflows, customer portals and plant floor dashboards. Those apps often hold the data a business runs on. When sign-in goes through SAML single sign-on, the identity provider's answer is the key to the app. If that answer can be replayed, an attacker can get in as whoever originally signed in, including an administrator.

Multi-factor authentication does not close this gap on its own. The MFA check happens at the identity provider when the original response is created. A replay reuses a response that already passed MFA, so the check is not triggered again. For more on why SSO raises the stakes, see our SSO checks after the DHS Okta breach.

It also matters who maintains these apps. Siemens distributes the fix as a new module version on the Mendix Marketplace. Every app that includes the module must be updated and redeployed by whoever looks after it. That might be an internal developer, a business unit that built the app itself, or an outside partner. If nobody owns that job, see Who Is Patching the Software That Runs Your Business?

What to do this week

If urgent fixes like this tend to wait weeks for approval, read our guide to getting security fixes approved faster.

Mendix SAML vulnerability questions people are asking

Is CVE-2026-89209 being exploited?

Neither the Siemens nor the CISA advisory reports exploitation. That can change, so update now rather than waiting for reports of attacks.

Which Mendix SAML versions fix the flaw?

V4.2.4 or later for Mendix 10 and Mendix 11 apps, and V3.6.29 or later for Mendix 9 apps. The same versions also fix CVE-2026-80465.

Am I affected if we do not use IdP-initiated login?

Siemens says CVE-2026-89209 affects IdP-initiated flows. Update anyway, because the same release completes the fix for CVE-2026-80465, which Siemens rates higher.

Is this a Siemens industrial control system vulnerability?

CISA published it with its industrial control system advisories because Siemens issued it. The affected product is the Mendix SAML module, which Siemens describes as a way to authenticate users in a cloud application. It is not a controller or PLC flaw.

Why is the score only Medium?

The CVSS 3.1 score of 6.8 reflects high attack complexity and the need for user interaction. If an attack works, the impact on confidentiality and integrity is rated high.

Does multi-factor authentication stop a SAML replay?

Not by itself. A replayed response has already passed MFA at the identity provider, so updating the module is the real fix.

The bigger lesson

Single sign-on puts a lot of trust in one handshake between your identity provider and your apps. The code that checks that handshake sits inside each app, and it needs updates like any other software. This module has needed replay fixes more than once, and its September fix had to be redone in October. Know which apps you run, know who updates them, and check the version that is actually deployed.

To tighten sign-in and patching across your systems, see security hardening or request a tech quote.

Get security alerts like this by email, plus our free checklist, at security alerts.

Sources: Siemens SSA-137528; CISA ICSA-26-302-01; Siemens SSA-887643; CVE-2022-44457 record.