Description

A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-09-03T13:06:10.877Z",
  "pubdate": "2026-09-03T13:06:10.877Z",
  "executiveSummary": "A critical security vulnerability exists within the Mendix SAML modules due to improper cryptographic signature validation of incoming SAML assertions. This flaw allows an unauthenticated remote attacker to bypass the identity provider (IdP) authentication handshake process.\nBy crafting a malicious SAML response, an attacker can impersonate arbitrary users, leading to unauthorized account takeover and session hijacking. This vulnerability affects Mendix SAML (Mendix 10 compatible) versions < V4.2.3, Mendix SAML (Mendix 11 compatible) versions < V4.2.3, and Mendix SAML (Mendix 9.24 compatible) versions < V3.6.27.\nThe vulnerability poses a severe risk to confidentiality and integrity in Single Sign-On (SSO) configurations, as the trust relationship between the Service Provider (SP) and the IdP is effectively nullified. Attackers do not require prior credentials or legitimate IdP signatures to successfully exploit the flaw. Organizations relying on affected versions of the Mendix SAML module should prioritize upgrading to the patched versions immediately to prevent unauthorized access.",
  "technicalDetails": "The vulnerability resides in the core assertion processing logic of the affected Mendix SAML modules. Specifically, the module fails to enforce strict cryptographic verification of the XML signature included within the SAML Response or Assertion elements. In a secure SAML implementation, the Service Provider must validate that the assertion was signed by the trusted IdP's private key using the corresponding public key and verify the integrity of the XML document structure.\nDue to the failure to validate the signature, the module treats an unsigned or incorrectly signed assertion as authentic. An attacker can initiate an SSO flow by injecting a crafted SAML Assertion into the SP's Assertion Consumer Service (ACS) endpoint. Since the module does not perform mandatory signature verification, the attacker can manipulate the 'NameID' or other subject attributes within the SAML payload to map their request to a high-privileged user account within the Mendix application.\nThe attack flow is characterized as follows: First, the attacker identifies a target application utilizing the vulnerable Mendix SAML module. Second, the attacker constructs an XML-based SAML response containing the desired target user identifier. Third, the attacker transmits this crafted payload via an HTTP POST request to the application's SAML ACS endpoint. Fourth, the application processes the assertion, skips the cryptographic signature check, and proceeds to establish a session for the attacker, authenticated as the victim user.\nThe root cause is a deficiency in the XML Security implementation within the module, where the validation routine is either omitted or improperly implemented, failing to throw an exception upon encountering missing or invalid signatures. This vulnerability is remotely exploitable without authentication, requiring only network access to the application's SSO endpoint. The post-exploitation impact is complete authentication bypass, granting the attacker the identity and privileges associated with the spoofed user account, effectively enabling persistent session hijacking and lateral movement within the application context. The vulnerability exists across multiple compatibility versions, specifically Mendix 9.24, 10, and 11, indicating a systemic flaw in the shared codebase responsible for SAML metadata and assertion processing."
}