CVE-2026-89209 is an authentication bypass vulnerability in Siemens Mendix SAML modules for Mendix 9, 10, and 11 compatible versions prior to 3.6.29 and 4.2.4 respectively. The flaw allows unauthenticated remote attackers to replay valid SAML assertions in IdP-initiated authentication flows, potentially gaining unauthorized access to applications.