The vulnerability lies in the failure of the Mendix SAML module to validate the cryptographic signature on SAML responses. An attacker can send an unsigned or incorrectly signed SAML response to a target application that accepts SAML input, allowing the session to be hijacked without authentication and giving the attacker access to the victim’s account. This weakness is classified as CWE-347, indicating improper validation of a digital signature.

Siemens’ Mendix SAML module for Mendix 10 compatible, all versions below 4.2.4; for Mendix 11 compatible, all versions below 4.2.4; and for Mendix 9.24 compatible, all versions below 3.6.29. These modules integrate SAML-based single sign-on into Mendix applications and the flaw exists in any installation still running the specified legacy versions.

The CVSS score of 8.8 places the issue in the high severity range; the EPSS score of <1% indicates a very low, but not zero, likelihood of exploitation. Although the vulnerability is not listed in CISA’s KEV catalog, the high severity and absence of signature validation mean the flaw can be exploited in environments where SAML responses are received from trusted identity providers but not enforced. The attacker does not need prior authentication or access to the identity provider, making the attack path relatively straightforward in the described SSO configurations.