CVE-2026-80465
Quick assessment
Affected
Siemens Mendix SAML (Mendix 10 compatible)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
已在以下 Mendix SAML 模块版本中发现漏洞： 适用于 Mendix 10 的 Mendix SAML 模块（所有低于 V4.2.3 的版本） 适用于 Mendix 11 的 Mendix SAML 模块（所有低于 V4.2.3 的版本） 适用于 Mendix 9.24 的 Mendix SAML 模块（所有低于 V3.6.27 的版本） 受影响版本的模块未能正确验证 SAML 响应签名。在特定的 SSO 配置下，未经身份验证的远程攻击者可能借此劫持用户账户（会话）。
Possible ATT&CK Techniques 1 AI
T1079Affected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Siemens | Mendix SAML (Mendix 10 compatible) | < V4.2.3 |
affected |
| Siemens | Mendix SAML (Mendix 11 compatible) | < V4.2.3 |
affected |
| Siemens | Mendix SAML (Mendix 9.24 compatible) | < V3.6.27 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-80465
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Siemens | Mendix SAML (Mendix 10 compatible) | 0 ~ V4.2.3 | - |
|
| Siemens | Mendix SAML (Mendix 11 compatible) | 0 ~ V4.2.3 | - |
|
| Siemens | Mendix SAML (Mendix 9.24 compatible) | 0 ~ V3.6.27 | - |
|
II. Public POCs for CVE-2026-80465
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-80465
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-80465 (1)
IV. Related Vulnerabilities
Same vendor: Siemens
-
CVE-2026-66155
Siemens Element maps-ng V47 跨站脚本漏洞 -
CVE-2026-54548
kas: Persistent SSH Host Key Checking Disablement -
CVE-2026-47192
kas's late signature validation may allow unnoticed reposito -
CVE-2026-47191
kas checks out SHA-like git branches as valid commits -
CVE-2026-69109
Siemens License Server 路径遍历漏洞
Same weakness: CWE-347
-
CVE-2026-80098
Copilot Studio Elevation of Privilege Vulnerability -
CVE-2026-84185
Jwcrypto: jwcrypto: general json jws kid binding bypass duri -
CVE-2026-85394
python-jose through 3.5.0 Algorithm Confusion via DER-encode -
CVE-2026-85393
node-forge through 1.4.0 RSA PKCS#1 v1.5 Signature Forgery v -
CVE-2026-82876
Phison PS3111-S11 Controller Firmware Signature Verification
V. Comments for CVE-2026-80465
No comments yet