A valid assertion can be reused
Siemens disclosed an authentication bypass in the Mendix SAML module on October 26. CVE-2026-89209 concerns replay of a valid SAML response during identity-provider-initiated authentication. The vendor says an unauthenticated remote attacker could use that weakness to gain application access.
Separate module branches
The advisory directs Mendix 9-compatible installations to module version 3.6.29 or later. Mendix 10- and 11-compatible installations require 4.2.4 or later. Siemens also identifies disabling identity-provider-initiated single sign-on as a mitigation.
Why application inventory matters
The affected component sits where an application accepts authentication evidence from another system. The incident-response question is consequently narrower than whether the identity provider itself is patched: which deployed applications include the affected module and permit this flow? The advisory describes a vulnerability, not a confirmed intrusion or a finding that all SAML deployments are exposed. Its branch-specific fixes make application ownership and module version records consequential to remediation.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
