{"id":"CVE-2026-80465","revision":"0599171fde414ec58eaa64e8aeee49d4","records":[{"revision":"0599171fde414ec58eaa64e8aeee49d4","observedAt":"2026-10-26T11:35:56.866+00:00","statement":{"source":"cve-program","id":"CVE-2026-80465","aliases":[],"title":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.29). Affected versions …","description":"A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.29). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.","state":0,"publishedAt":"2026-09-03T11:25:10.771+00:00","modifiedAt":"2026-10-26T10:40:59.986+00:00","affected":[{"ecosystem":"Vendor product","name":"Mendix SAML (Mendix 10 compatible)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Siemens\",\n                    \"product\": \"Mendix SAML (Mendix 10 compatible)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"V4.2.4\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"},{"ecosystem":"Vendor product","name":"Mendix SAML (Mendix 11 compatible)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Siemens\",\n                    \"product\": \"Mendix SAML (Mendix 11 compatible)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"V4.2.4\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"},{"ecosystem":"Vendor product","name":"Mendix SAML (Mendix 9.24 compatible)","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Siemens\",\n                    \"product\": \"Mendix SAML (Mendix 9.24 compatible)\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"V3.6.29\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unknown\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","score":8.7,"severity":"HIGH"},{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N","score":8.8,"severity":"HIGH"}],"references":["https://cert-portal.siemens.com/productcert/html/ssa-887643.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80465","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80465","identifiers":["CVE-2026-80465"]},"retained":false,"historicalAffected":[]}],"coverage":[]}