Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-89209

Quick assessment

Affected
Siemens Mendix SAML (Mendix 10 compatible)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Mendix SAML（兼容 Mendix 10）（所有低于 V4.2.4 的版本）、Mendix SAML（兼容 Mendix 11）（所有低于 V4.2.4 的版本）以及 Mendix SAML（兼容 Mendix 9）（所有低于 V3.6.29 的版本）中发现了一个安全漏洞。受影响版本的模块未能正确防范在身份提供者（IdP）发起的认证流程中的 SAML 断言重放攻击。这可能导致未认证的远程攻击者通过重放有效的 SAML 响应，从而获得对应用程序的未授权访问权限。

CVSS 6.8 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89209

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9 compatible) (All versions < V3.6.29). Affected versions of the module do not properly protect against SAML assertion replay in IdP-initiated authentication flows. This could allow unauthenticated remote attackers to gain unauthorized access to the application by replaying a valid SAML response.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Siemens Mendix SAML (Mendix 10 compatible) 0 ~ V4.2.4 -
Siemens Mendix SAML (Mendix 11 compatible) 0 ~ V4.2.4 -
Siemens Mendix SAML (Mendix 9 compatible) 0 ~ V3.6.29 -

II. Public POCs for CVE-2026-89209

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89209

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-89209 (1)

IV. Related Vulnerabilities

Same product: Mendix SAML (Mendix 10 compatible)
Same vendor: Siemens
Same weakness: CWE-294