Mendix SAML module contains a vulnerability, which Siemens self-reported, that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.
Mendix provided fixed releases for the Mendix SAML module and recommends to update to the latest version.
The following versions of Siemens Mendix SAML suffer from the issue:
- Mendix SAML (Mendix 10 compatible) versions up to 4.2.3
- Mendix SAML (Mendix 11 compatible) versions up to 4.2.3
- Mendix SAML (Mendix 9.24 compatible) versions up to 3.6.27
In the vulnerability, affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.
CVE-2026-80465 is the case number for the vulnerability, which has a CVSS V3 base score of 8.7.
The product sees use mainly in the critical manufacturing and information technology sectors, and on a global basis.
In terms of mitigations, users can:
- Update to V3.6.27 or later version
- Update to V4.2.3 or later version
- Update to V4.2.3 or later version
As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for Industrial Security, and following the recommendations in the product manuals.
Click here for additional information on Industrial Security by Siemens.
For further inquiries on security vulnerabilities in Siemens products and solutions, contact Siemens ProductCERT.
For more information see the associated Siemens security advisory SSA-887643 in HTML and CSAF.