Zero Radar
← feed
HighVulnerabilityCVE-2026-89209updated 29 Oct 2026, 14:59 UTC

Mendix SAML module can let attackers log in by replaying a valid login response

A login helper used by Mendix apps can be tricked: someone who captures a valid single sign-on login message can reuse it to get into the application without a password. Updating the module closes this gap.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesMendix SAML (Mendix 10 and 11 compatible) V4.2.4 or later; Mendix SAML (Mendix 9 compatible) V3.6.29 or later · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker captures loginObtains a valid SAML response
  2. 2Attacker replays responseSends the same SAML response again
  3. 3App accepts replayModule does not block reused assertion
  4. 4Unauthorized accessAttacker is logged in as the victim
  5. ResultAttacker gains unauthorized application access

What happened

The Mendix SAML module does not properly protect against replay of SAML assertions in IdP-initiated authentication flows, allowing an unauthenticated remote attacker to reuse a valid SAML response.

Why it is dangerous: An attacker who obtains a valid SAML response can gain unauthorized access to the application, bypassing normal authentication. Organizations running affected Mendix apps with SAML single sign-on are at risk.

Are you affected?

You are affected if you run a Mendix app using the Mendix SAML module (Mendix 9, 10, or 11 compatible) with IdP-initiated single sign-on enabled.

Mendix SAML (Mendix 10 compatible) < V4.2.4; Mendix SAML (Mendix 11 compatible) < V4.2.4; Mendix SAML (Mendix 9 compatible) < V3.6.29

What to do

  1. Update the Mendix SAML module to V4.2.4 or later (Mendix 10/11) or V3.6.29 or later (Mendix 9)
  2. If you cannot update right away, disable IdP-initiated SSO as a temporary mitigation
  3. Review authentication logs for unexpected logins while the module was unpatched

Timeline

  1. 26 Oct 2026, 11:16 UTC
    Publicly disclosed
  2. 26 Oct 2026, 11:16 UTC
    Reported by NVD · NVD
  3. 26 Oct 2026, 11:18 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 14:59 UTC
    CISA reported on it · CISA

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-89209
CVSS
7.6 / 10
EPSS
0.3% chance of exploitation within 30 days
Disclosed
26 Oct 2026, 11:16 UTC
On Zero Radar
26 Oct 2026, 11:18 UTC (2 min after disclosure)
Last change
29 Oct 2026, 14:59 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Mendix SAML module can let attackers log in by replaying a valid login response · Zero Radar