The vulnerability resides in the Mendix SAML module provided by Siemens and affects all releases of the module that are incompatible with a specified version threshold. It allows an unauthenticated remote attacker to replay a valid SAML assertion during an IdP-initiated authentication flow, resulting in unauthorized access to the protected application. The flaw is a classic example of improper authorization, identified as CWE‑294.

This flaw touches Siemens Mendix SAML deployments for Mendix 10, 11, and 9 compatibility. Any installation of the Mendix SAML module earlier than V4.2.4 for the 10 and 11 compatible builds, or earlier than V3.6.29 for the 9 compatible build, is vulnerable. Systems using those modules are at risk if they rely on IdP-initiated SAML.

The CVSS score of 7.6 classifies the issue as high severity, and the EPSS score is not available, suggesting limited current exploitation data. Because the attack requires a valid SAML assertion and an IdP that can be forced to deliver a replayable assertion, environments that permit IdP-initiated logins without replay protections are the most susceptible. The vulnerability does not appear in the CISA KEV catalog, so it has not yet been widely exploited in the wild according to current records.