CVE-2026-80465: CWE-347: Improper Verification of Cryptographic Signature in Siemens Mendix SAML (Mendix 10 compatible)

This vulnerability (CWE-347) affects Mendix SAML modules compatible with Mendix versions 9.24, 10, and 11. Specifically, all versions prior to 4.2.3 for Mendix 10 and 11 compatible modules, and prior to 3.6.27 for Mendix 9.24 compatible module, fail to correctly validate the SAML response signature. This improper verification can lead to session hijacking by unauthenticated remote attackers under specific SSO setups. The CVSS v3.1 base score is 8.7, indicating high severity with network attack vector, high impact on confidentiality and integrity, no privileges or user interaction required, and scope changed.

Successful exploitation allows an unauthenticated remote attacker to hijack user sessions by bypassing SAML response signature verification. This compromises confidentiality and integrity of user sessions in affected Mendix SAML modules, potentially leading to unauthorized access to sensitive application resources. There is no indication of impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the Siemens vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Users should monitor Siemens advisories for updates and apply patches once available. Until then, consider reviewing SSO configurations to limit exposure where possible.