CVE-2026-80465Disclosure

🔴 Siemens Mendix SAML flaw allows account hijacking via SSO misconfiguration Siemens Mendix SAML module contains a vulnerability (CVE-2026-80465) that permits unauthenticated remote attackers to hijack accounts in specific single sign-on configurations. The flaw stems from improper validation of SAML response signatures. Affected versions: • Mendix SAML (Mendix 10 compatible) < V4.2.3 • Mendix SAML (Mendix 11 compatible) < V4.2.3 • Mendix SAML (Mendix 9.24 compatible) < V3.6.27 Siemens has released patched versions and recommends immediate updates. The module is deployed worldwide in critical manufacturing and information technology sectors.

TRC analysis shows attackers exploiting CVE-2026-80465 in Siemens Mendix SAML modules to hijack user sessions through signature validation bypass. Following authentication bypass, threat actors pivot through compromised SSO sessions to access connected industrial systems. Runtime segmentation helps contain lateral movement across manufacturing networks. #ZeroTrust #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/siemens-mendix-saml-authentication-bypass-cve-2026-80465

🚨 [IDENTITY SECURITY] — SIEMENS DISCLOSES MENDIX SAML FLAW THAT CAN LET AN UNAUTHENTICATED REMOTE ATTACKER HIJACK USER SESSIONS CVE-2026-80465 affects Mendix 9.24, 10 and 11-compatible SAML modules because some versions fail to correctly validate SAML response signatures. CyberSignal Priority: 🔴 VERY HIGH 📅 September 3, 2026 🔐 CVE-2026-80465 📊 CVSS v3.1: 8.7 HIGH 📊 CVSS v4.0: 8.8 HIGH 🏢 Siemens · Mendix 🔑 SAML · SSO 🏷️ Identity · Authentication · Session Hijacking · Enterprise Apps ### 🔎 What happened Siemens ProductCERT disclosed a vulnerability in: MENDIX SAML. The problem: IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURES. In certain SSO configurations, affected versions do not correctly validate: THE SAML RESPONSE SIGNATURE. ### ⚔️ Attack chain Attacker crafts/manipulates SAML response ↓ vulnerable Mendix SAML processing ↓ signature verification insufficient ↓ malicious response accepted under required conditions ↓ legitimate authenticated session hijacked ↓ ACCOUNT ACCESS. No prior authenticated account is required for the attacker under Siemens' CVSS v3.1 assessment. ### 🎯 Affected versions Mendix 9.24-compatible SAML: BEFORE 3.6.27. Mendix 10-compatible SAML: BEFORE 4.2.3. Mendix 11-compatible SAML: BEFORE 4.2.3. ### 🔐 Why this matters SAML sits directly on an enterprise: TRUST BOUNDARY. The normal flow: IDENTITY PROVIDER ↓ SIGNED ASSERTION ↓ APPLICATION VERIFIES SIGNATURE ↓ USER TRUSTED. If verification fails: ATTACKER-CONTROLLED ASSERTION ↓ APPLICATION MAY TRUST WRONG IDENTITY. That undermines the entire point of federated authentication. ### 🧠 Potential impact A successful session hijack can expose: enterprise application data user privileges internal workflows connected APIs business records. Impact depends heavily on: WHOSE SESSION IS HIJACKED. Compromising an administrator is not equivalent to compromising a low-privilege user. ### ⚠️ Important caveat The attack requires: SPECIFIC SSO CONDITIONS. Siemens rates attack complexity as: HIGH. There is also no indication in Siemens' advisory that exploitation is currently occurring in the wild. ### 🛡️ Defender action Upgrade: Mendix 9.24 SAML → 3.6.27+ Mendix 10/11 SAML → 4.2.3+. Then review: SAML issuers trusted certificates unexpected assertion activity unusual session creation authentication logs administrative access. ### 🧠 CyberSignal insight SSO simplifies identity because many applications trust: ONE AUTHENTICATION PIPELINE. That is also why a flaw in that pipeline can become: ONE FAILURE POINT FOR MANY APPLICATIONS. Sources: Siemens ProductCERT