CVE-2026-89209

MediumCVSS 6.8/10Last modified Oct 31, 2026

Description

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
Siemens	Mendix SAML (Mendix 10 compatible)	< V4.2.4
Siemens	Mendix SAML (Mendix 11 compatible)	< V4.2.4
Siemens	Mendix SAML (Mendix 9 compatible)	< V3.6.29

References

https://cert-portal.siemens.com/productcert/html/ssa-137528.html

Timeline

Published: Oct 26, 2026
Last modified: Oct 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-89218.5External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privi CVE-2026-892128.6A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-J CVE-2026-892138.6The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which al CVE-2026-892148.6The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, whic CVE-2026-892168.6The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows CVE-2026-89225.4A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Conne CVE-2026-892295.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai CVE-2026-89238.7Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution CVE-2026-892328.6The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthent CVE-2026-892348.6The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthentica CVE-2026-892356.8The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allo CVE-2026-892368.6The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of