Executive Summary

CVE-2026-89209 allows an unauthenticated remote attacker to replay a captured SAML response in IdP-initiated authentication flows and gain unauthorized access to applications built on the Mendix SAML module. For OT-adjacent deployments that use Mendix low-code applications as operator dashboards, work order systems, or plant data portals, this means a stolen or intercepted assertion can be reused to impersonate a legitimate authenticated session.

Technical Exposure Breakdown

The defect is an assertion replay weakness. In a properly implemented SAML service provider, each assertion carries anti-replay protections: a unique ID, tight NotBefore and NotOnOrAfter validity windows, and an InResponseTo correlation value that binds the response to a request the SP actually issued. IdP-initiated flows remove the InResponseTo binding by design, because there is no prior AuthnRequest from the SP. That absence shifts the entire replay defense onto the SP's own tracking of consumed assertion IDs and strict timestamp enforcement.

According to the grounding data, the affected module does not properly protect against replay in these IdP-initiated flows. The practical consequence is that a valid SAML response, once observed, can be submitted again to the Assertion Consumer Service endpoint and accepted as a fresh authentication. An attacker does not need credentials. They need a copy of a valid response, obtainable through a logging sink, a proxy, a compromised intermediary, a browser history artifact, or any point where the base64-encoded response transits in the clear or is retained.

The CVSS score is 6.8. Exploitation conditions depend on the attacker's ability to capture a usable assertion within its validity window. Where assertion lifetimes are generous, the window to replay widens significantly.

OT Impact and Compliance Risk

Mendix applications increasingly sit at the IT/OT boundary as operational portals, maintenance interfaces, and reporting layers that read from or write to process systems. A successful replay grants application-level session access as whatever identity the original assertion represented. If that identity has rights to submit work orders, acknowledge alarms, adjust setpoints exposed through the application, or pull sensitive process topology data, the attacker inherits those rights.

Under IEC 62443, this is an authentication integrity failure in the identification and authentication control family. Compensating controls at the zone boundary become the relevant discussion rather than the application itself. For NERC CIP environments, any Mendix portal classified as an Electronic Access Control or Monitoring System or residing inside an Electronic Security Perimeter inherits CIP-005 and CIP-007 scrutiny, and an authentication bypass is directly material to access control evidence. Pipeline operators under TSA SD-02C should treat this as an access control gap that undermines the required segmentation and identity assurance between IT and OT. Water utilities under AWIA 2018 risk assessments should account for the same identity assurance erosion where Mendix portals touch SCADA data.

Compensating Controls

Do not rely on scheduling an application update as the only response. Active scanning to fingerprint these endpoints inside an OT network can disrupt fragile industrial components, so inventory through passive means and configuration review rather than probing.

Treat any identity with OT-relevant rights that authenticates through these modules as potentially compromised until flows are hardened, and review application access logs for duplicate assertion submissions.

BreachSpider Intel

BreachSpider tracks CVE-2026-89209 and related authentication bypass exposures across OT-adjacent application stacks, with BreachSpider's AI analysis flagging affected deployments for monitoring.