The vulnerability lies in Mendix SAML module's failure to validate the SAML response signature. An attacker can send an unsigned or incorrectly signed SAML response to a target application configured for single sign-on. This bypass allows the attacker to hijack an existing user session without authentication, potentially granting full access to the victim's account. The weakness is classified as CWE-347, indicating improper signature validation.

Siemens' Mendix SAML module for Mendix 10 compatible (all versions below 4.2.3), Mendix 11 compatible (also below 4.2.3), and Mendix 9.24 compatible (below 3.6.27) are affected. These modules are used to integrate SAML-based single sign-on into Mendix applications, and the vulnerability applies to any installation still running the specified legacy versions.

The CVSS score of 8.8 places this issue in the high severity range, and the lack of an EPSS score means the exploitation probability is uncertain. Because the flaw allows unauthenticated remote attackers to hijack sessions, it is potentially exploitable in environments where SAML responses are received from trusted identity providers but not properly validated. The vulnerability is not yet listed in CISA's KEV database, indicating no public exploit samples are known, but the high severity warrants active monitoring.