Live › vulnerability › CVE-2026-89209
Go to dashboardThe Mendix SAML module does not properly stop replay of SAML assertions in IdP-initiated sign-in flows. An unauthenticated remote attacker who captures a valid SAML response can replay it to gain unauthorized access to the application.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
Applications built on the Mendix platform that use the Mendix SAML module for single sign-on, with affected versions below the fixed releases. The sources describe the exposure as IdP-initiated authentication flows, so apps that only use SP-initiated login or no SAML at all are likely not affected, but the sources do not confirm this.
No product ranges from the sources yet.
V4.2.4 or later.V3.6.29 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
This page as .md · .json · in your agent: get_signal("CVE-2026-89209")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.