CVE-2026-89209: SAML Replay Vulnerability in Mendix Authentication

CVE-2026-89209 identifies a SAML assertion replay vulnerability in Mendix SAML modules for Mendix 9, 10, and 11. The flaw affects IdP-initiated authentication flows: affected versions do not properly protect against replay of valid SAML responses. This allows unauthenticated remote attackers to gain unauthorized access to Mendix applications using this SAML authentication configuration.

The CVSS score is 6.8 (medium severity). The vulnerability was published in NVD on October 26, 2026, and has received attention from official sources, with mentions of CISA and Siemens in public signals. Although the number of social media posts is limited (1 post in the last 24 hours), consistency with official sources confirms the validity of the report. No public exploits have been published in major GitHub repositories so far.

Administrators and sysadmins must immediately update the Mendix SAML module to the correct versions: V4.2.4 or higher for Mendix 10 and 11, or V3.6.29 or higher for Mendix 9. It is advisable to check authentication logs to detect any suspicious replay attempts. If immediate update is not feasible, implement additional session controls and verify IdP configuration to limit the reuse of valid SAML responses.