CVE-2025-40758
High
Description
A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.
SeverityHigh
CVSS8.7
Exploit probability—
ProductMendix SAML (Mendix 10.12 compatible)
PublishedAug 14, 2025
First seenAug 14, 2025
Weakness typeCWE-347CWE-347
How to fix
Update
- Siemens Mendix SAML (Mendix 10.12 compatible)V4.0.3 or later
- Siemens Mendix SAML (Mendix 10.21 compatible)V4.1.2 or later
- Siemens Mendix SAML (Mendix 9.24 compatible)V3.6.21 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens Mendix SAML (Mendix 10.12 compatible) | v < V4.0.3 | V4.0.3 |
| Siemens Mendix SAML (Mendix 10.21 compatible) | v < V4.1.2 | V4.1.2 |
| Siemens Mendix SAML (Mendix 9.24 compatible) | v < V3.6.21 | V3.6.21 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.