Siemens Mendix SAML Updates Block Assertion Replay
Tech GuruQuick Answer
CISA ICSA-26-302-01 and Siemens SSA-137528 cover SAML assertion replay in Mendix applications. Inventory module versions and IdP-initiated SSO, update to 4.2.4 or 3.6.29, disable IdP-initiated SSO until fixed where feasible, validate authentication and sessions, and retain evidence.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Mendix 9, 10 and 11 applications using the Siemens SAML module, exact module releases, IdP-initiated flows, identity providers, session logs, owners, and maintenance windows. Confirm an affected module release and IdP-initiated authentication; do not infer that all Mendix applications or every SAML flow is exposed. Update to SAML module 4.2.4 or later for Mendix 10 and 11, or 3.6.29 or later for Mendix 9; disable IdP-initiated SSO as Siemens' mitigation until the update is active. Confirm module versions, test service-provider- and identity-provider-initiated login as applicable, verify replay rejection and session behavior, review anomalies where warranted, and retain evidence.
Last verified: 2026-10-30 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Siemens Mendix SAML module for Mendix 9, 10, and 11 |
|---|---|
| Advisory | ICSA-26-302-01 / SSA-137528 |
| CVE | CVE-2026-89209 |
| Authoritative release date | 2026-10-29 12:00:00 UTC |
| Authority revision date | 2026-10-29 12:00:00 UTC |
| Affected versions | Mendix 10- and 11-compatible SAML module releases before 4.2.4 and Mendix 9-compatible releases before 3.6.29 when IdP-initiated authentication is used. |
| Fixed version | Mendix SAML 4.2.4 or later for Mendix 10 and 11, and 3.6.29 or later for Mendix 9 |
| CVSS base score | 6.8 (CVSS v3.1) |
| CVSS severity | Medium |
| Exploitation status | CISA does not state that this vulnerability is being maliciously exploited.; no exploitation claim is inferred. |
What Changed
Siemens and CISA describe an authentication bypass in which an unauthenticated remote attacker can replay a valid SAML assertion in IdP-initiated flows.
What To Validate Now
- Inventory. Inventory Mendix 9, 10 and 11 applications using the Siemens SAML module, exact module releases, IdP-initiated flows, identity providers, session logs, owners, and maintenance windows.
- Establish applicability. Confirm an affected module release and IdP-initiated authentication; do not infer that all Mendix applications or every SAML flow is exposed.
- Remediate. Update to SAML module 4.2.4 or later for Mendix 10 and 11, or 3.6.29 or later for Mendix 9; disable IdP-initiated SSO as Siemens' mitigation until the update is active.
- Validate. Confirm module versions, test service-provider- and identity-provider-initiated login as applicable, verify replay rejection and session behavior, review anomalies where warranted, and retain evidence.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Authentication changes can interrupt access and federation. Coordinate with application and identity owners, preserve session evidence, and avoid weakening assertion validation to restore service.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
