What Happened
CISA has published an advisory for a critical authentication bypass vulnerability (CVE-2026-89209) in the Siemens Mendix SAML module. The flaw allows unauthenticated attackers to replay captured SAML assertions during IdP-initiated authentication flows, effectively bypassing login protections and gaining unauthorized access to applications. All versions of the SAML module for Mendix 9, 10, and 11 are affected. Siemens has released patched versions and urges immediate updates.
Why SMBs Should Care
If your organization uses Mendix low-code applications with SAML-based single sign-on (common in environments integrating with Azure AD, Okta, or other identity providers), this vulnerability creates a direct path for attackers to impersonate legitimate users. Replay attacks are particularly dangerous because they don't require credential theft or phishing; an attacker who intercepts or captures a valid SAML token can reuse it to gain access. For SMBs relying on Mendix for customer portals, internal tools, or workflow automation, this represents a serious identity and access management risk. Patching should be prioritized, and organizations should review SAML configurations to ensure proper token expiration and replay protection are in place.
How O-Cyrus Can Help
O-Cyrus helps SMBs assess identity and access management risks, audit authentication configurations, and implement secure SSO practices. If you're unsure whether your environment is affected or need help prioritizing patches, contact our security team or visit o-cyrus.com to learn more about our infrastructure and security services.
Need a hand with this?
O-Cyrus helps small businesses with websites, DNS, custom apps, and the everyday tech that keeps things running.
Talk to us →