Siemens Mendix SAML module suffers authentication bypass via replay

1. Executive summary

Siemens published SSA-137528 on 2026-10-26, republished by CISA on 2026-10-29 as ICSA-26-302-01, covering an authentication bypass in the Mendix SAML module (CVE-2026-89209). An unauthenticated remote attacker can replay a valid SAML assertion in IdP-initiated authentication flows and gain access without credentials. The affected module is the SAML component of Mendix low-code applications, with fixes at 4.2.4 for the Mendix 10 and 11 compatible lines and 3.6.29 for the Mendix 9 line. No CVSS score, CWE, EPSS value or CISA KEV entry is available for this CVE in the sources reviewed, so severity is stated as unrated here rather than inferred. For EMEA financial services the exposure is concentrated in customer-facing or internal Mendix applications that authenticate staff or clients through SAML SSO: a successful replay yields a session as the victim identity, and the blast radius is whatever that identity can reach.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

The vulnerability is an authentication bypass by capture-replay in the SAML module's handling of IdP-initiated flows. The advisory names the mechanism and the affected component but gives no protocol-level detail: it does not state which assertion fields are checked, whether the replay window is bounded by NotOnOrAfter, whether the module validates InResponseTo or Destination, or whether the flaw is a missing one-time-use check on the assertion ID. Those specifics are absent from both the Siemens text and the CISA republication and should be requested from Siemens ProductCERT or read from the CSAF document before any compensating control is designed around an assumed mechanism.

Confirmed steps, as far as the source supports them:

1. The attacker obtains a valid SAML assertion issued by the identity provider for a legitimate user. The advisory does not say how; capture from browser history, logs, a referrer leak or a compromised endpoint are all consistent with a replay flaw but none is stated.
2. The attacker submits that assertion to a Mendix application running an affected SAML module version, in an IdP-initiated authentication flow.
3. The module accepts the replayed assertion and establishes an authenticated session as the assertion's subject. No credentials and no interaction with the identity provider are required at this stage.

Affected versions, from the CISA republication:

The primary advisory's version table lists only "Mendix SAML (Mendix 10 compatible)" at CVSS v3 6.8; the CISA republication of the same SSA carries the fuller version matrix above and the CVE identifier. The 6.8 figure appears in the vendor table without a vector string, and no NVD record was available to corroborate it, so treat it as a vendor-assigned score rather than a validated one.

A related but distinct issue is worth separating. ICSA-26-258-06 (SSA-887643, September 2026) covers CWE-347, improper verification of the SAML response signature, CVSS 3.1 8.7, fixed in 3.6.27 and 4.2.3. That is a signature-validation failure; this item is a replay of an assertion that was validly signed. An organisation that patched to 3.6.27 or 4.2.3 in September is still exposed to CVE-2026-89209 and needs the later builds. The two advisories share a component and a marketplace link, nothing more.

No exploitation has been reported in either source. No actor, tooling, infrastructure or post-exploitation behaviour is described. Nothing in the material indicates ransomware, data theft or extortion, and no attribution is offered or implied.

4. Mitigation & containment

P1, within 24 hours:

• Inventory every Mendix application in the estate and record the deployed SAML module version. The module is distributed through the Mendix Marketplace (https://marketplace.mendix.com/link/component/1174), so the version is visible in the app's module dependencies and in the deployment package.
• For any application on a version below 4.2.4 (Mendix 10 or 11 line) or 3.6.29 (Mendix 9 line), treat the deployment as exposed. Where the application is internet-facing and the fix cannot be applied inside 24 hours, restrict access at the reverse proxy or WAF to known source ranges, or place it behind the corporate VPN, until the module is upgraded.
• Search identity provider logs for SAML assertions presented more than once, and for assertions presented from a source IP or user agent that differs from the session that originally consumed them. This is the only detection route the sources support, and it depends on the IdP retaining assertion IDs and timestamps.

P2, within 72 hours:

• Upgrade the SAML module to 4.2.4 or later on the Mendix 10 and 11 lines, and to 3.6.29 or later on the Mendix 9 line, then redeploy and restart the affected applications. Confirm the running version after deployment rather than trusting the build manifest.
• Where the identity provider supports it, shorten assertion lifetime and enable one-time-use enforcement on assertion IDs at the IdP, so a replayed assertion is rejected upstream of the module. This is a compensating control, not a substitute for the upgrade.
• Review Mendix application access rules for the System.User entity. ICSA-26-209-02 (SSA-887643's sibling, CVSS 9.1, CWE-277) documents that access rules on a System.User specialization do not override the platform's built-in rules, and that an anonymous role with a System.User entity can reach all stored records. An authentication bypass is materially worse on an application with that misconfiguration, because the replayed session inherits the over-permissive model.

P3, within 7 days:

• Add SAML assertion replay to the threat model for any new Mendix deployment, and pin the SAML module version in the build pipeline so a downgrade is caught at release.
• Confirm with Siemens ProductCERT what the module actually validates, so that monitoring can be tuned to the real failure mode rather than to a guess.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe no hashes, domains, IP addresses, file paths or command lines. The observable behaviour is authentication-side only.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The sources give no file artefacts, strings, command lines, registry keys or network values to build a YARA or Sigma rule from. A rule keyed on the CVE identifier or the product name would match reporting about the vulnerability, not exploitation of it. Detection has to be built locally against the identity provider's assertion logs, using the behavioural indicators in section 5, once the organisation has confirmed what its IdP records for assertion ID and consumption time.

7. Sources

• Siemens ProductCERT via CISA, "Siemens Mendix SAML Module" (ICSA-26-302-01, SSA-137528), 2026-10-29. https://www.cisa.gov/news-events/ics-advisories/icsa-26-302-01
• Siemens ProductCERT via CISA, "Siemens Mendix SAML" (ICSA-26-258-06, SSA-887643), 2026-09-03. https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-06
• Siemens ProductCERT via CISA, "Siemens Mendix Runtime" (ICSA-26-209-02), 2026. https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-02

8. Adverse Trace position

Adverse Trace assesses CVE-2026-89209 as an unrated authentication bypass with a narrow but high-value effect: it converts a captured assertion into a live session without credentials, and the sources give no CVSS score, CWE, EPSS estimate or CISA KEV status to calibrate exploitation likelihood, so we are not assigning a severity band the vendor has not published. The 6.8 in the vendor table is unaccompanied by a vector and uncorroborated by NVD at the time of writing. Client impact depends entirely on what the affected Mendix application exposes and what the replayed identity can reach; an application with the System.User access-rule misconfiguration from ICSA-26-209-02 is the worst case. The version matrix and CVE identifier rest on the CISA republication of SSA-137528, which is single-sourced to Siemens and should be verified against the CSAF document before it is used to scope a patch campaign. We will request the protocol-level detail from Siemens ProductCERT, re-check NVD and CISA KEV for CVE-2026-89209, and reissue this advisory if a score, exploitation report or actor attribution appears.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.