Our takeSiemens Mendix SAML module lets unauthenticated remote attackers hijack accounts in some SSO setups. Update to the latest version now.Cyber Resilience desk
Sources (1)
- cisa_ics · cisa_ics
What this means for you — Security leader:Update the Mendix SAML module to version 4.0.0 or later immediately if you use it for SSO; this fixes an unauthenticated account hijack in specific configurations.
What this means for you — Lean IT orgs:If your team uses Mendix for apps with single sign-on, update the SAML module to the newest version right away. Most small teams can do this through the Mendix admin console.
What this means for you — MSP:Check every client running Mendix 10 for the SAML module and update it to v4.0.0+; the vulnerability allows unauthenticated remote account takeover in certain SSO setups.
What this means for you — Researcher:Review affected Mendix SAML versions below 4.0.0 and test the updated module against account hijacking in misconfigured IdP/SP setups.