CVE-2025-40571 identifies a privilege assignment vulnerability (CWE-266) in Siemens Mendix OIDC SSO modules compatible with Mendix 9 and 10 versions. The vulnerability arises because the module grants read and write access to all tokens exclusively to the Administrator role, which is intended for secure token management. However, this privilege assignment is flawed in versions prior to 4.1.0 (Mendix 10 compatible), 4.0.1 (Mendix 10.12 compatible), and 3.3.0 (Mendix 9 compatible). During Mendix application development, an adversary with administrative access could exploit this misconfiguration to modify the OIDC SSO module, potentially leading to privilege misuse such as unauthorized token manipulation. The vulnerability does not affect confidentiality, integrity, or availability significantly beyond the scope of administrative users, and no user interaction is required. The CVSS 3.1 score is 2.2, reflecting low severity due to the requirement of high privileges and the complexity of exploitation. No public exploits have been reported, and Siemens has published the vulnerability with no direct patch links available yet, indicating that fixed versions are expected or released. This vulnerability highlights the importance of correct privilege assignment in identity and access management modules, especially those handling OIDC tokens in enterprise applications.

For European organizations, the impact of CVE-2025-40571 is primarily limited to environments where Mendix OIDC SSO modules are used in development or production and where administrative privileges might be compromised or misused. Since the vulnerability requires administrative privileges to exploit, the risk is mainly insider threats or attackers who have already gained high-level access. Potential impacts include unauthorized modification of token handling, which could lead to privilege escalation or unauthorized access to protected resources within Mendix applications. However, the vulnerability does not directly compromise confidentiality, integrity, or availability for general users or external attackers without admin access. Organizations relying on Mendix for critical business applications should be cautious, as misuse during development could introduce security weaknesses or backdoors. The low CVSS score and absence of known exploits suggest limited immediate risk, but the vulnerability underscores the need for strict access controls and monitoring of administrative actions in Mendix environments.

1. Upgrade affected Mendix OIDC SSO modules to the latest fixed versions: V4.1.0 or later for Mendix 10 compatible, V4.0.1 or later for Mendix 10.12 compatible, and V3.3.0 or later for Mendix 9 compatible. 2. Restrict administrative privileges strictly to trusted personnel and enforce the principle of least privilege during Mendix development and deployment. 3. Implement robust auditing and monitoring of administrative actions within Mendix environments to detect unauthorized modifications to OIDC SSO modules or token handling processes. 4. Use role-based access control (RBAC) to segregate duties and minimize the number of users with full token read/write access. 5. Conduct regular security reviews and code audits of Mendix applications and modules, especially those handling authentication and token management. 6. Employ multi-factor authentication (MFA) for all administrative accounts to reduce the risk of credential compromise. 7. Isolate development environments from production to limit the impact of any potential misuse during development phases. 8. Stay informed on Siemens Mendix security advisories for any patches or updates related to this vulnerability.