Siemens fixes a SAML replay flaw in the Mendix single sign-on module

Siemens fixes a SAML replay flaw in the Mendix single sign-on module

26 October 2026: Siemens has fixed CVE-2026-89209 in the Mendix SAML module, the component that lets apps built on its Mendix low-code platform sign users in through a corporate identity provider. The module did not stop a valid SAML response from being used twice in identity-provider-initiated sign-on, so an attacker who obtained one could replay it and get into the app as that user. The fix is version 4.2.4 for Mendix 10 and 11.

Not yet independently verified. The 3.6.29 fix for Mendix 9 comes from Italy's CSIRT alert; we did not find that line in the text of Siemens' advisory itself. No exploitation has been reported. We will update this when it can be confirmed, and remove this note.

Siemens ProductCERT published advisory SSA-137528 on 26 October. Italy's national CSIRT issued an alert the same day, rating the risk high and giving 3.6.29 as the fixed version for apps still on Mendix 9.

How the replay works

In identity-provider-initiated sign-on, the user starts at the identity provider, which posts a signed assertion to the app. Replay protection normally means the app remembers each assertion it has accepted and refuses it a second time. The Mendix module lacked that check (CWE-294), so a response captured from a browser, a proxy log or a compromised machine stayed usable for as long as its validity window allowed. Siemens scores it 6.8 under CVSS 3.1 and 7.6 under CVSS 4.0, noting that an attack needs user interaction and is not trivial to set up.

Fixed versions and the workaround

• Mendix 10 and 11: SAML module 4.2.4 or later, from the Mendix Marketplace
• Mendix 9: SAML module 3.6.29 or later, according to CSIRT Italia

The module is updated per app, not per platform, so every app that uses it has to be rebuilt and redeployed with the new version. Where that cannot happen soon, Siemens' workaround is to switch off identity-provider-initiated sign-on and let users start from the app, which goes through service-provider-initiated sign-on and request IDs instead.

Where to look first

Apps exposed to the internet that accept sign-on from a shared identity provider are the priority, since that is where an assertion is most likely to be captured and where a replay reaches the most data. Logs from the identity provider can show whether the same assertion ID ever arrived at an app twice. Mendix is listed in our catalogue, and our low-code development platform category holds 11 products, most of which handle single sign-on through their own modules rather than the platform core.

Related on TrustList:

• Citrix fixes CVSS 9.5 NetScaler SAML flaw; no attacks seen so far
• NetScaler SAML zero-day CVE-2026-88779: check Gateway and AAA SAML configurations and upgrade to 14.1-73.41 or 13.1-64.28

Sources

• Siemens ProductCERT: SSA-137528, SAML assertion replay vulnerability in Mendix SAML module, 26 October 2026
• ACN CSIRT Italia: Siemens, risolta vulnerabilita in Mendix SAML (AL05/261026/CSIRT-ITA), 26 October 2026