---
id: "CVE-2026-89209"
kind: "vulnerability"
aliases: ["CVE-2026-89209"]
title: "Mendix SAML: replayed SAML responses grant unauthorized access to applications"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["low-code", "mendix", "package", "saml", "sso"]
not_affected_if: ["no-saml-sso", "sp-initiated-only"]
published_at: "2026-10-26T11:16:38+00:00"
first_seen_at: "2026-10-26T11:29:41+00:00"
updated_at: "2026-10-26T11:30:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89209", "first_seen_at": "2026-10-26T11:29:41+00:00"}]
---

# Mendix SAML: replayed SAML responses grant unauthorized access to applications

The Mendix SAML module does not properly stop replay of SAML assertions in IdP-initiated sign-in flows. An unauthenticated remote attacker who captures a valid SAML response can replay it to gain unauthorized access to the application.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Mendix SAML module version in the Mendix project's app dependencies: unknown whether the sources name the exact file or setting.
- Confirm whether the app uses IdP-initiated SAML login: unknown if the sources do not say how to verify this.

## Fix

- Upgrade Mendix SAML for Mendix 10 and 11 to `V4.2.4` or later.
- Upgrade Mendix SAML for Mendix 9 to `V3.6.29` or later.

## Timeline

- 2026-10-26T11:29:41+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-89209

## From the sources

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_