CVE-2026-80465 in Mendix SAML
Summary
by MITRE • 09/03/2026
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The identified vulnerability resides within the Mendix SAML authentication modules, specifically affecting versions prior to V4.2.3 for Mendix 10 and Mendix 11 compatibility layers, as well as versions prior to V3.6.27 for the Mendix 9.24 compatible module. This security flaw is rooted in a critical failure of cryptographic validation mechanisms during the Single Sign-On process. When an identity provider sends a SAML response to the service provider, which in this case is the Mendix application server, the system is responsible for verifying that the digital signature on the assertion matches the expected public key and has not been tampered with. The affected versions fail to properly validate this SAML response signature, effectively bypassing one of the primary integrity checks defined by the OASIS Security Assertion Markup Language standard. This deficiency allows an attacker who can intercept or manipulate network traffic between the identity provider and the service provider to inject a forged assertion that appears valid to the application logic despite lacking proper cryptographic proof of authenticity.
From a technical perspective, this vulnerability represents a classic case of improper input validation regarding security-critical data structures. The SAML protocol relies heavily on XML Digital Signatures to ensure both integrity and authentication of the identity assertions passed between parties. By neglecting to verify that the signature corresponds to the trusted certificate or key associated with the configured identity provider, the application accepts any assertion structure presented by a client-side actor capable of modifying HTTP requests. This flaw aligns directly with CWE-347, which describes Improper Verification of Cryptographic Signature, and is closely related to CWE-287 regarding Improper Authentication. The absence of this check means that the confidentiality and integrity guarantees provided by SAML are nullified for any session established through this specific authentication flow.
The operational impact of this vulnerability is severe, as it enables unauthenticated remote attackers to hijack user sessions and impersonate legitimate users within the Mendix application environment. In configurations where Single Sign-On is utilized, an attacker can craft a malicious SAML response containing arbitrary attributes or subject identifiers that map to high-privilege accounts or specific target identities known to exist in the system. Upon receiving this forged assertion, the vulnerable module will authenticate the user without requiring valid credentials from the identity provider. This leads directly to unauthorized access, data exfiltration, and potential lateral movement within the enterprise network if the compromised account possesses administrative privileges or access to sensitive business logic. The attack vector is remote and does not require prior authentication, making it particularly dangerous in internet-facing deployments where SSO endpoints are exposed.
To mitigate this risk, organizations must immediately upgrade the Mendix SAML module to version V4.2.3 or later for Mendix 10 and 11 compatible systems, and to version V3.6.27 or later for Mendix 9.24 compatible systems. These updated versions contain the necessary code patches to enforce strict signature verification against trusted certificates before processing any SAML assertions. In addition to upgrading software, security teams should review their identity provider configurations to ensure that only expected issuers are accepted and consider implementing additional controls such as enforcing HTTPS for all communication channels between the service provider and identity providers to prevent man-in-the-middle attacks from altering or injecting responses. Continuous monitoring of authentication logs for anomalous login patterns can also help detect exploitation attempts in real-time, providing an extra layer of defense while patching efforts are underway.