CVE-2026-89209 in Mendix SAML
Summary
by MITRE • 10/26/2026
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The identified vulnerability affects multiple compatible versions of the Mendix SAML module, specifically those prior to version 4.2.4 for Mendix 10 and Mendix 9 compatibility layers, as well as versions below 3.6.29 for Mendix 11. This security flaw resides within the implementation of Security Assertion Markup Language authentication flows, particularly impacting IdP-initiated scenarios where the Identity Provider redirects users to the Service Provider with a signed assertion. The core technical deficiency is the absence of proper validation mechanisms to detect and reject duplicate or previously processed SAML assertions. In standard secure implementations, systems must maintain state regarding consumed assertions within a specific time window to prevent an attacker from capturing a valid response and re-submitting it to gain access without possessing current credentials.
From a technical perspective, this failure constitutes a classic replay attack vector where the application fails to enforce uniqueness constraints on incoming authentication tokens. When a user successfully authenticates via SAML, the Service Provider receives a signed assertion containing claims about the user's identity. If the system does not track which assertions have already been processed or validate that each request is unique through nonces and issue timestamps strictly enforced against replay attempts, an adversary can intercept these network packets during transit. By capturing this valid response, the attacker can subsequently send it to the application repeatedly, effectively bypassing authentication controls because the server accepts the reused token as a legitimate new login event rather than recognizing it as a stale or duplicated message.
The operational impact of this vulnerability is severe, allowing unauthenticated remote attackers to gain unauthorized access to sensitive applications hosted on Mendix platforms. Since SAML assertions often contain critical identity claims and role assignments, successfully replaying one grants the attacker full privileges associated with that user account without needing to crack passwords or exploit other authentication weaknesses. This compromises confidentiality by exposing private data accessible only to authenticated users and undermines integrity as actions performed under the compromised session are attributed to the legitimate victim. Furthermore, this flaw aligns directly with CWE-294, which describes Improper Authentication: Acceptance of a Replayed Credential, highlighting the systemic failure in verifying the freshness and uniqueness of authentication artifacts.
To mitigate this risk, organizations must immediately upgrade their Mendix SAML modules to version 4.2.4 or later for Mendix 10 and 9 compatibility layers, and version 3.6.29 or higher for Mendix 11 compatible environments. These updated versions implement robust checks that validate the uniqueness of each assertion by checking nonce values against a cache of recently processed requests within an appropriate time window. Additionally, administrators should ensure that their Identity Providers are configured to include unique nonces and precise issue instants in every SAML response, which allows Service Providers to effectively detect replay attempts. Monitoring logs for repeated authentication successes from the same source IP or user agent can also help identify ongoing exploitation of this vulnerability before it leads to significant data breaches. This mitigation strategy addresses the root cause by enforcing strict state management on incoming security tokens, thereby neutralizing the attack vector described in MITRE ATT&CK technique T1078, specifically relating to Valid Accounts and authentication bypass mechanisms.