Siemens Mendix SAML Module versions below 4.2.4 and 3.6.29 contain an authentication bypass vulnerability. An unauthenticated remote attacker could exploit this by replaying a valid SAML assertion in IdP-initiated authentication flows. The flaw allows unauthorized access to the application by replaying a valid SAML response. Siemens has released updated versions and recommends users update to the latest releases. The advisory was initially released on 2026-10-26 and republished by CISA on 2026-10-29.
Read the full story at cisa.gov.
