CVE-2026-80465
High
Description
A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.29). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.
SeverityHigh
CVSS8.7
Exploit probability—
ProductMendix SAML (Mendix 10 compatible)
PublishedSep 3, 2026
First seenSep 3, 2026
Weakness typeCWE-347CWE-347
How to fix
Update
- Siemens Mendix SAML (Mendix 10 compatible)V4.2.4 or later
- Siemens Mendix SAML (Mendix 11 compatible)V4.2.4 or later
- Siemens Mendix SAML (Mendix 9.24 compatible)V3.6.29 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Siemens Mendix SAML (Mendix 10 compatible) | v < V4.2.4 | V4.2.4 |
| Siemens Mendix SAML (Mendix 11 compatible) | v < V4.2.4 | V4.2.4 |
| Siemens Mendix SAML (Mendix 9.24 compatible) | v < V3.6.29 | V3.6.29 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.