Siemens Mendix SAML Flaw Enables Login Bypass via Assertion Replay

Key points

• CVE-2026-89209 affects Siemens Mendix SAML Module and Mendix 9, 10, and 11.
• An attacker without credentials can reuse a valid SAML assertion to gain unauthorized access.
• Exposure is global and relevant to IT and critical manufacturing environments.
• Apply vendor updates promptly and review SAML logs for replay indicators.

A newly tracked security issue, CVE-2026-89209, affects Siemens' Mendix SAML integration and several Mendix release lines. The weakness allows someone who has no account or prior access to bypass the sign-in process. The described mechanism is assertion replay: a legitimate SAML message that is still accepted can be presented again to establish a session. That turns a captured or otherwise obtainable token into a path to unauthorized entry.

Because Mendix is used to build and run business applications, the blast radius is not limited to a single desktop. The issue is described as global in scope and relevant to information technology and critical manufacturing settings. In a K-12 or government context, any Mendix-backed service that relies on SAML single sign-on should be treated as potentially exposed until the vendor's update is applied and the deployment is checked.

The highest risk is not a crash or data corruption but quiet access. An attacker who can replay an assertion may appear as a valid user, making ordinary password controls ineffective. Schools and departments should watch for unusual sessions, repeated assertion identifiers, logins from unexpected locations, and service accounts or administrative roles being used outside normal patterns.

Siemens lists affected products including the Mendix SAML Module and Mendix 9, 10, and 11. The immediate action is to update affected products according to vendor guidance. Teams should also review identity provider and application logs for signs that a still-valid assertion was reused. If detection is uncertain, tighten SAML audience and recipient checks where supported and shorten assertion lifetimes.

Watch for updated vendor advisories, exploit attempts against internet-facing Mendix apps, and any broadening of affected versions. Prioritize internet-exposed and privileged integrations first, then move to internal business apps. Because the flaw is an authentication bypass, treat any suspicious successful login as a potential compromise rather than a routine event.

What to do now

1. Inventory all Mendix deployments and SAML module versions; flag internet-facing and privileged applications first.
2. Apply Siemens updates for CVE-2026-89209 to Mendix 9, 10, and 11 and the SAML module as vendor guidance directs.
3. Review identity provider and Mendix authentication logs for repeated assertion IDs, duplicate SAML responses, and anomalous login locations.
4. Force re-authentication and revoke active sessions for affected applications after patching.
5. Restrict access to Mendix management and SAML endpoints with network controls and strong authentication where possible.
6. Shorten SAML assertion validity and enforce audience and recipient constraints if the platform supports it.
7. Monitor vendor advisories and threat intelligence for exploitation attempts; escalate suspicious successful logins.

CVE references

• CVE-2026-89209

Original source

CISA Advisories