SAML Replay Flaw in Siemens Mendix Exposes Industrial Apps to Auth Bypass

As reported by CISA in advisory ICSA-26-302-01, Siemens has disclosed an authentication bypass vulnerability in its Mendix SAML module that allows unauthenticated remote attackers to replay valid SAML assertions in IdP-initiated authentication flows. The flaw, tracked as CVE-2026-89209, carries a CVSS v3.1 base score of 6.8 (Medium) and affects multiple Mendix platform generations deployed across critical manufacturing and IT sectors worldwide.

Vulnerability Overview

Why This Matters

SAML replay attacks are a class of authentication bypass that often flies under the radar in enterprise environments. The vulnerability class — CWE-294: Authentication Bypass by Capture-replay — exploits the absence of proper assertion validity windows or nonce tracking in IdP-initiated flows. An attacker who can intercept or otherwise obtain a legitimate SAML response (via network positioning, proxy logs, shared links, or compromised endpoints) can replay it to establish an authenticated session without credentials.

What elevates this particular advisory is the Mendix platform's footprint in critical manufacturing environments. Mendix low-code applications are frequently used to build internal operational tools, dashboards, and workflow systems that interface with industrial processes. An authentication bypass against these applications could provide attackers a foothold into OT-adjacent infrastructure, potentially enabling reconnaissance, data exfiltration, or lateral movement toward more sensitive ICS components.

The CVSS score of 6.8 may understate the practical risk. While the vector requires user interaction (UI:R) and high attack complexity (AC:H), these factors are situational. In environments where SAML assertions are logged, cached, or transmitted over channels susceptible to interception, the complexity bar drops significantly. Defenders should not treat this as a low-priority patch.

Who Is Most at Risk

• Critical manufacturing organizations running Mendix-based applications for production workflows, quality management, or supply chain coordination
• Organizations with IdP-initiated SSO enabled as the primary or sole authentication flow for Mendix applications
• Environments lacking TLS inspection controls or where SAML assertions traverse multiple intermediary systems
• Large enterprises with federated identity architectures where SAML tokens may be cached by intermediary services or proxies

The core issue is that affected Mendix SAML module versions do not enforce replay protection on IdP-initiated authentication flows — meaning a captured SAML response can be resubmitted to establish a new authenticated session. This is a protocol implementation deficiency, not a cryptographic weakness in SAML itself.

Shield53 Recommendations

Immediate Actions

Hardening and Detection

• Enforce short assertion validity windows (NotBefore/NotOnOrAfter) in your IdP configuration. While the patched module enforces replay protection, tightening time windows reduces the practical exploitation window for any similar future issues.
• Implement network-level controls restricting access to Mendix application endpoints. Follow Siemens' operational guidelines for Industrial Security to ensure Mendix apps are not exposed to untrusted networks.
• Deploy detection rules monitoring for SAML response submissions that lack corresponding IdP-initiated login events, or multiple successful authentications using the same assertion ID within the validity window.

This advisory is a reminder that SSO implementation quality matters as much as the underlying protocol. Organizations relying on SAML federation for any application — not just Mendix — should verify that their service providers enforce replay protection on all authentication flows, including IdP-initiated ones. The absence of nonce validation or assertion consumption tracking is a systemic weakness that affects many SAML implementations beyond this single vendor.